CVE-2013-0202

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-17 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter to core/ajax/sharing.php.

Affected products

ownCloud: from 4.0.0 before 4.0.11; from 4.5.0 before 4.5.6 — fixed in 4.0.11, 4.5.6

How to fix

Upgrade to a fixed version: ownCloud 4.0.11, 4.5.6. Check the vendor advisory for mitigations.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/81476
https://owncloud.org/security/advisories/multiple-xss-vulnerabilities-3/
https://exchange.xforce.ibmcloud.com/vulnerabilities/81476
https://owncloud.org/security/advisories/multiple-xss-vulnerabilities-3/

Get alerted when CVE-2013-0202 or the next vulnerability affects your stack