Vulnerability ownCloud gives access to admin password

A vulnerability in the storage software ownCloud allows attackers to capture admin passwords and attacks have now been seen in the wild. Nextcloud is not affected by the vulnerability.

OwnCloud already posted last week about the vulnerability and security company Greynoise says that exploits have been seen in the wild that exploit the vulnerability. Those attacks seem to have little chance, according to security researcher Will Dormann says that the exploit tries to use a URI that does not exist and would only work on systems running in a container anyway.

The vulnerability works by being able to request plaintext data via a phpinfo function in the ‘graphapi’. OwnCloud advises users to change passwords and other private data anyway. The phpinfo function is also disabled. Nextcloud, which is affiliated with ownCloud, says of this vulnerability not to suffer.

OwnCloud 2.0