Server-Side Request Forgery in federated sharing API may allow an unauthenticated attacker to identify internal servers. Furthermore, due to improper timeout handling, the server could be affected by a Denial of Service attack.
Affected
ownCloud (owncloud/core) <10.15.0
Action taken
Upgrade ownCloud 10 Server to version 10.15.0 or above
Credits
The ownCloud Team would like to thank
Gilles Petit
for discovering these vulnerabilities.
