Test ID:	1.3.6.1.4.1.25623.1.0.804660
Category:	Web application abuses
Title:	ownCloud Multiple Vulnerabilities (oC-SA-2013-014, oC-SA-2013-015)
Summary:	ownCloud is prone to multiple vulnerabilities.
Description:	Summary: ownCloud is prone to multiple vulnerabilities. Vulnerability Insight: - CVE-2013-1941: Due to using 'time()' as random source in the ownCloud installation routine, the entropy of the generated PostgreSQL database user password is very low and can be easily guessed. This issue is inside the ownCloud setup routine and is not related to any PostgreSQL vulnerability. - CVE-2013-1942: A cross-site scripting (XSS) vulnerability allows remote attackers to execute arbitrary javascript when a user opens a special crafted URL. This vulnerability exists in the bundled 3rdparty plugin 'jPlayer', 'jPlayer' released version 2.2.20 which addresses the problem. Affected Software/OS: ownCloud 4.0.x through 4.0.13, 4.5.x through 4.5.8 and 5.0.x through 5.0.3. Solution: Update to version 4.0.14, 4.5.9, 5.0.4 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-1941 Common Vulnerability Exposure (CVE) ID: CVE-2013-1942 20130421 Vulnerabilities in jPlayer http://seclists.org/fulldisclosure/2013/Apr/192 59030 http://www.securityfocus.com/bid/59030 [oss-security] 20130411 CVE-2013-1942 jPlayer 2.2.19 XSS http://marc.info/?l=oss-security&m=136570964825921&w=2 [oss-security] 20130429 Re: CVE-2013-1942 jPlayer 2.2.19 XSS http://marc.info/?l=oss-security&m=136726705917858&w=2 [oss-security] 20130505 Re: CVE-2013-1942 jPlayer 2.2.19 XSS http://marc.info/?l=oss-security&m=136773622321563&w=2 http://owncloud.org/about/security/advisories/oC-SA-2013-014/ http://www.jplayer.org/2.3.0/release-notes/ https://github.com/happyworm/jPlayer/commit/e8ca190f7f972a6a421cb95f09e138720e40ed6d
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.