{"id":"CVE-2015-6670","aliases":["DSA-3373-1","EUVD-2015-6608","GHSA-jm84-v35x-p8jw","MGASA-2015-0378"],"status":"published","title":"ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check...","description":"ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01417,"percentile":0.72946,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2015-09-18T15:57:28Z","modified":"2026-06-17T00:31:13Z","affected":[{"source":"osv","ecosystem":"Debian:8","package":"owncloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4+dfsg-4~deb8u3"}]}],"versions":["7.0.4+dfsg-2","7.0.4+dfsg-3","7.0.4+dfsg-4~deb8u1","7.0.4+dfsg-4~deb8u2"],"bundled":8},{"source":"osv","ecosystem":"Mageia:5","package":"owncloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.8-1.mga5"}]}],"bundled":2}],"products":[{"vendor":"owncloud","product":"owncloud_server"}],"references":[{"url":"http://www.debian.org/security/2015/dsa-3373","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://owncloud.org/security/advisory/?id=oc-sa-2015-015","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6670"},{"url":"https://github.com/advisories/GHSA-jm84-v35x-p8jw"},{"url":"https://advisories.mageia.org/MGASA-2015-0378.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16771","tags":["report"]},{"url":"https://owncloud.org/security/advisory/?id=oc-sa-2015-014","tags":["advisory"]},{"url":"https://owncloud.org/changelog/","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-6670","description":"ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.","status":"published","published":"2015-10-26T14:00:00Z","modified":"2024-08-06T07:29:24.456Z","updated_at":"2026-11-02T14:35:42.680858Z"}],"euvd":[{"id":"EUVD-2015-6608","description":"ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.","status":"published","published":"2015-10-26T14:00:00Z","modified":"2024-08-06T07:29:24Z","updated_at":"2026-11-03T02:21:55.290228Z"}],"ghsa":[{"id":"GHSA-jm84-v35x-p8jw","title":"ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check...","description":"ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.","status":"published","published":"2022-05-17T00:28:14Z","modified":"2023-02-03T05:01:47Z","updated_at":"2026-11-02T14:53:02.192117Z"}],"nvd":[{"id":"CVE-2015-6670","description":"ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.","status":"published","published":"2015-10-26T14:59:09.577Z","modified":"2026-06-17T00:31:13.02Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:12.30866Z"}],"osv":[{"id":"DSA-3373-1","title":"owncloud - security update","status":"published","published":"2015-10-18T00:00:00Z","modified":"2026-03-09T01:18:40.736999Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0378","title":"Updated owncloud packages fix security vulnerabilities","description":"Updated owncloud package fixes security vulnerabilities:\n\nIn ownCloud before 8.0.6, due to an incorrect usage of an ownCloud internal\nfile system function the passed path to the file scanner was resolved\nrelatively. An authenticated adversary may thus be able to get a listing of\ndirectories (but not the containing files) existing on the filesystem.\nHowever, it is not possible to access any of these files (CVE-2015-6500).\n\nIn ownCloud before 8.0.6, due to not properly checking the ownership of an\ncalendar, an authenticated attacker is able to download calendars of other\nusers via the \"calid\" GET parameter to export.php in /apps/calendar/\n(CVE-2015-6670).\n\nThe owncloud package has been updated to version 8.0.8, which fixes these\nissues, as well as other bugs and other not-yet-disclosed security issues.\n","status":"published","published":"2015-09-18T15:57:28Z","modified":"2026-04-16T06:26:27.805050615Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}