Every CVESearch/Get API key

CVE-2015-6670

ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check...

4.0 Medium

CVE-2015-6670 is a medium vulnerability (CVSS 4.0) in Owncloud Server, published September 18, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.42%, the 73rd percentile. No source names a fixed version.

Severity
4.0 MediumCVSS 2.0, NVD
Exploit chance
1.42%EPSS, 73rd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.

Exploit likelihood

1.42%Up 0.4 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
owncloud
Debian:8
From an advisory covering 8 CVEs
before 7.0.4+dfsg-4~deb8u3, plus listed versions
7.0.4+dfsg-27.0.4+dfsg-37.0.4+dfsg-4~deb8u17.0.4+dfsg-4~deb8u2
7.0.4+dfsg-4~deb8u3
owncloud
Mageia:5
From an advisory covering 2 CVEs
before 8.0.8-1.mga5
8.0.8-1.mga5

What each source reports

NVD Score used4.0

ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.

Record
CVE-2015-6670
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Updated
2026-11-02
CVE ListNo score

ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.

Record
CVE-2015-6670
Updated
2026-11-02
EUVDEUVD-2015-6608No score

ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.

Record
EUVD-2015-6608
Updated
2026-11-03
GitHub AdvisoriesGHSA-jm84-v35x-p8jwNo score

ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check...

ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.

Record
GHSA-jm84-v35x-p8jw
Updated
2026-11-02
OSVMGASA-2015-0378No score

Updated owncloud packages fix security vulnerabilities

Updated owncloud package fixes security vulnerabilities:

In ownCloud before 8.0.6, due to an incorrect usage of an ownCloud internal file system function the passed path to the file scanner was resolved relatively. An authenticated adversary may thus be able to get a listing of directories (but not the containing files) existing on the filesystem. However, it is not possible to access any of these files (CVE-2015-6500).

In ownCloud before 8.0.6, due to not properly checking the ownership of an calendar, an authenticated attacker is able to download calendars of other users via the "calid" GET parameter to export.php in /apps/calendar/ (CVE-2015-6670).

The owncloud package has been updated to version 8.0.8, which fixes these issues, as well as other bugs and other not-yet-disclosed security issues.

Record
MGASA-2015-0378
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open