CVE-2015-7298

2015-10-2614:59:10

mitre

web.nvd.nist.gov

owncloud

desktop client

ssl errors

mitm

cve-2015-7298

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

AI Score

6.2

Confidence

Low

EPSS

0.002

Percentile

59.0%

JSON

ownCloud Desktop Client before 2.0.1, when compiled with a Qt release after 5.3.x, does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which makes it easier for remote attackers to conduct man-in-the-middle (MITM) attacks by leveraging a server using a self-signed certificate. NOTE: this vulnerability exists because of a partial CVE-2015-4456 regression.

Affected configurations

Nvd

Node

owncloudowncloud_desktop_clientRange≤2.0.0

qtqtMatch5.3.0

qtqtMatch5.4.1

VendorProductVersionCPE
owncloudowncloud_desktop_client*cpe:2.3:a:owncloud:owncloud_desktop_client:*:*:*:*:*:*:*:*
qtqt5.3.0cpe:2.3:a:qt:qt:5.3.0:*:*:*:*:*:*:*
qtqt5.4.1cpe:2.3:a:qt:qt:5.4.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
owncloud	owncloud_desktop_client	*	cpe:2.3:a:owncloud:owncloud_desktop_client::::::::
qt	qt	5.3.0	cpe:2.3:a:qt:qt:5.3.0:::::::*
qt	qt	5.4.1	cpe:2.3:a:qt:qt:5.4.1:::::::*