CVE-2014-2052 - Vulnerability Details - OpenCVE

Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Owncloud	Owncloud Owncloud Server

Configuration 1 [-]

OR	cpe:2.3:a:owncloud:owncloud::::::::
	cpe:2.3:a:owncloud:owncloud_server::::::::

No data.

References

Link	Providers
http://owncloud.org/about/security/advisories/oC-SA-2014-006/
https://owncloud.org/security/advisories/xxe-multiple-third-party-components/
https://www.securityfocus.com/bid/66222

History

Mon, 31 Mar 2025 12:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Owncloud owncloud Server
CPEs		cpe:2.3:a:owncloud:owncloud_server::::::::
Vendors & Products		Owncloud owncloud Server

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-02-11T15:23:46

Updated: 2024-08-06T09:58:16.229Z

Reserved: 2014-02-19T00:00:00

Link: CVE-2014-2052

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-02-11T16:15:12.430

Modified: 2025-03-31T11:54:18.823

Link: CVE-2014-2052

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-03-07T00:00:00", "descriptions": [{"lang": "en", "value": "Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-02-11T15:23:46", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://owncloud.org/about/security/advisories/oC-SA-2014-006/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://owncloud.org/security/advisories/xxe-multiple-third-party-components/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.securityfocus.com/bid/66222"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2014-2052", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://owncloud.org/about/security/advisories/oC-SA-2014-006/", "refsource": "MISC", "url": "http://owncloud.org/about/security/advisories/oC-SA-2014-006/"}, {"name": "https://owncloud.org/security/advisories/xxe-multiple-third-party-components/", "refsource": "CONFIRM", "url": "https://owncloud.org/security/advisories/xxe-multiple-third-party-components/"}, {"name": "https://www.securityfocus.com/bid/66222", "refsource": "MISC", "url": "https://www.securityfocus.com/bid/66222"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T09:58:16.229Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://owncloud.org/about/security/advisories/oC-SA-2014-006/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://owncloud.org/security/advisories/xxe-multiple-third-party-components/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.securityfocus.com/bid/66222"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2014-2052", "datePublished": "2020-02-11T15:23:46", "dateReserved": "2014-02-19T00:00:00", "dateUpdated": "2024-08-06T09:58:16.229Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*", "matchCriteriaId": "266B14BE-B8FA-4C64-8603-A733EA0E58B1", "versionEndExcluding": "5.0.15", "vulnerable": true}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "DC4CAC61-0CDE-45E2-8EEB-03DD0C4631D6", "versionEndExcluding": "6.0.2", "versionStartIncluding": "6.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack."}, {"lang": "es", "value": "Zend Framework, como es usado en ownCloud Server versiones anteriores a 5.0.15 y versiones 6.0.x anteriores a 6.0.2, permite a atacantes remotos leer archivos arbitrarios, causar una denegaci\u00f3n de servicio o posiblemente tener otro impacto por medio de un ataque de tipo XML External Entity (XXE)."}], "id": "CVE-2014-2052", "lastModified": "2025-03-31T11:54:18.823", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-02-11T16:15:12.430", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://owncloud.org/about/security/advisories/oC-SA-2014-006/"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://owncloud.org/security/advisories/xxe-multiple-third-party-components/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.securityfocus.com/bid/66222"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://owncloud.org/about/security/advisories/oC-SA-2014-006/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://owncloud.org/security/advisories/xxe-multiple-third-party-components/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.securityfocus.com/bid/66222"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}]}