UBUNTU-CVE-2015-4715

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2015-4715

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-4715.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2015-4715

Upstream

CVE-2015-4715

Withdrawn

2025-07-18T16:43:14Z

Published

2020-02-17T19:15:00Z

Modified

2025-07-16T07:33:03.857188Z

Severity

4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ (at sign) character in unspecified POST values.

References

Affected packages

Ubuntu:16.04:LTS / php-dropbox

Package

Name: php-dropbox
Purl: pkg:deb/ubuntu/php-dropbox@1.0.0-4?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.0-4

Affected versions

1.*

1.0.0-3

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "php-dropbox",
            "binary_version": "1.0.0-4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-4715.json"