CVE-2013-2042

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the url parameter to (1) apps/bookmarks/ajax/addBookmark.php or (2) apps/bookmarks/ajax/editBookmark.php.

Published: Mar 14, 2014
Updated: Nov 9, 2025
CVE: CVE-2013-2042
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
owncloud / owncloud	-	4.0.14.x
owncloud / owncloud_server	4.0.0	4.0.0.x
owncloud / owncloud_server	4.0.1	4.0.1.x
owncloud / owncloud_server	4.0.2	4.0.2.x
owncloud / owncloud_server	4.0.3	4.0.3.x
owncloud / owncloud_server	4.0.4	4.0.4.x
owncloud / owncloud_server	4.0.5	4.0.5.x
owncloud / owncloud_server	4.0.6	4.0.6.x
owncloud / owncloud_server	4.0.7	4.0.7.x
owncloud / owncloud_server	4.0.8	4.0.8.x
owncloud / owncloud_server	4.0.9	4.0.9.x
owncloud / owncloud_server	4.0.10	4.0.10.x
owncloud / owncloud_server	4.0.11	4.0.11.x
owncloud / owncloud_server	4.0.12	4.0.12.x
owncloud / owncloud_server	4.0.13	4.0.13.x
owncloud / owncloud_server	4.5.1	4.5.1.x
owncloud / owncloud_server	4.5.2	4.5.2.x
owncloud / owncloud_server	4.5.3	4.5.3.x
owncloud / owncloud_server	4.5.4	4.5.4.x
owncloud / owncloud_server	4.5.5	4.5.5.x
owncloud / owncloud_server	4.5.6	4.5.6.x
owncloud / owncloud_server	4.5.7	4.5.7.x
owncloud / owncloud_server	4.5.8	4.5.8.x
owncloud / owncloud_server	4.5.9	4.5.9.x
owncloud / owncloud_server	4.5.10	4.5.10.x
owncloud / owncloud_server	5.0.0	5.0.0.x
owncloud / owncloud_server	5.0.1	5.0.1.x
owncloud / owncloud_server	5.0.2	5.0.2.x
owncloud / owncloud_server	5.0.3	5.0.3.x
owncloud / owncloud_server	5.0.4	5.0.4.x
owncloud / owncloud_server	5.0.5	5.0.5.x

http://owncloud.org/about/security/advisories/oC-SA-2013-021/

Vulnerability Database

308,926

CVE-2013-2042

Deep Security Visibility Without the Complexity