CVE-2023-24804

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-24804
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-24804.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-24804
Published
2023-02-13T16:28:43Z
Modified
2026-10-24T10:30:37Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
ownCloud Android app vulnerable to Path Traversal
Details

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path traversal issue and is vulnerable to two bypass methods. The bypasses may lead to information disclosure when uploading the app’s internal files, and to arbitrary file write when uploading plain text files (although limited by the .txt extension). Version 3.0 fixes the reported bypasses.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24804.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "3.0"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StringRangeExpression"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/owncloud/android

Affected ranges

Type
GIT
Repo
https://github.com/owncloud/android
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
494b2f7f524ba8c57e7623907d3be8b896a12213
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "3.0"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

1.*
1.4.6-easy-setup
Other
oc-android-1-3-13
oc-android-1-3-14
oc-android-1-3-17
oc-android-1-3-18
oc-android-1-3-19
oc-android-1-3-20
oc-android-1-4-0
oc-android-1.*
oc-android-1.4.3
oc-android-1.4.4
oc-android-1.4.5
oc-android-1.4.6
oc-android-1.5.3
oc-android-1.7.0
oc-android-1.7.0_signed
oc-android-1.7.1_signed
oc-android-1.8
oc-android-2.*
oc-android-2.1.0
oc-android-2.1.1
oc-android-2.1.2
oc-android-2.10.0
oc-android-2.10.0-beta.1
oc-android-2.13.1_oem
oc-android-2.2.0
oc-android-2.20_oem
oc-android-2.3.0
oc-android-2.4.0
oc-android-2.5.0
oc-android-2.5.0-beta.1
oc-android-2.5.0-beta.2
oc-android-2.6.0
oc-android-2.7.0
oc-android-2.7.0-beta.1
oc-android-2.8.0
oc-android-2.8.0-beta.1
oc-android-2.9.0
oc-android-2.9.1
oc-android-2.9.2
oc-android-2.9.3_oem

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-24804.json"