CVE-2013-2040

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Published: Mar 14, 2014
Updated: Nov 9, 2025
CVE: CVE-2013-2040
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
owncloud / owncloud	-	4.0.14.x
owncloud / owncloud_server	4.0.0	4.0.0.x
owncloud / owncloud_server	4.0.1	4.0.1.x
owncloud / owncloud_server	4.0.2	4.0.2.x
owncloud / owncloud_server	4.0.3	4.0.3.x
owncloud / owncloud_server	4.0.4	4.0.4.x
owncloud / owncloud_server	4.0.5	4.0.5.x
owncloud / owncloud_server	4.0.6	4.0.6.x
owncloud / owncloud_server	4.0.7	4.0.7.x
owncloud / owncloud_server	4.0.8	4.0.8.x
owncloud / owncloud_server	4.0.9	4.0.9.x
owncloud / owncloud_server	4.0.10	4.0.10.x
owncloud / owncloud_server	4.0.11	4.0.11.x
owncloud / owncloud_server	4.0.12	4.0.12.x
owncloud / owncloud_server	4.0.13	4.0.13.x
owncloud / owncloud_server	4.5.1	4.5.1.x
owncloud / owncloud_server	4.5.2	4.5.2.x
owncloud / owncloud_server	4.5.3	4.5.3.x
owncloud / owncloud_server	4.5.4	4.5.4.x
owncloud / owncloud_server	4.5.5	4.5.5.x
owncloud / owncloud_server	4.5.6	4.5.6.x
owncloud / owncloud_server	4.5.7	4.5.7.x
owncloud / owncloud_server	4.5.8	4.5.8.x
owncloud / owncloud_server	4.5.9	4.5.9.x
owncloud / owncloud_server	4.5.10	4.5.10.x
owncloud / owncloud_server	5.0.0	5.0.0.x
owncloud / owncloud_server	5.0.1	5.0.1.x
owncloud / owncloud_server	5.0.2	5.0.2.x
owncloud / owncloud_server	5.0.3	5.0.3.x
owncloud / owncloud_server	5.0.4	5.0.4.x
owncloud / owncloud_server	5.0.5	5.0.5.x

http://owncloud.org/about/security/advisories/oC-SA-2013-021/

Vulnerability Database

308,926

CVE-2013-2040

Deep Security Visibility Without the Complexity