CVE-2012-5607

Published: Dec 18, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack."

Affected (14)

Products: Owncloud: Owncloud, Owncloud Server

Owncloud

2 products

Owncloud

Owncloud Server

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Owncloud Owncloud	Up to 4.0.8
Owncloud Owncloud Server	Version 3.0.0
Owncloud Owncloud Server	Version 3.0.1
Owncloud Owncloud Server	Version 3.0.2
Owncloud Owncloud Server	Version 3.0.3
Owncloud Owncloud Server	Version 4.0.0
Owncloud Owncloud Server	Version 4.0.1
Owncloud Owncloud Server	Version 4.0.2
Owncloud Owncloud Server	Version 4.0.3
Owncloud Owncloud Server	Version 4.0.4
Owncloud Owncloud Server	Version 4.0.5
Owncloud Owncloud Server	Version 4.0.6
Owncloud Owncloud Server	Version 4.0.7
Owncloud Owncloud Server	Version 4.5.0