CVE-2012-4393

CVE-2012-4393 describes multiple Cross-Site Request Forgery (CSRF) vulnerabilities in ownCloud versions prior to 4.0.6, affecting numerous AJAX endpoints across various modules like bookmarks, calendar, files, and administrative settings. An unauthenticated attacker could exploit these vulnerabilities to hijack the authentication of arbitrary users, including administrators, to perform actions such as creating/deleting bookmarks, managing calendar events, manipulating files, or even changing user/group settings. With a CVSS score of 6.8, this vulnerability is of medium severity, indicating that an attacker could achieve partial confidentiality, integrity, and availability impact with medium attack complexity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.