CVE-2012-4752

## Vulnerability appconfig.php in ownCloud versions before 4.0.6 does not properly restrict access, allowing remote authenticated users to edit app configurations via unspecified vectors (CVE-2012-4752). This issue can be combined with CVE-2012-4393 for exploitation by unauthenticated attackers [1].

Exploitation

An attacker needs valid authenticated credentials to ownCloud. The exact vectors are unspecified, but the lack of access control permits direct editing of app configurations. Unauthenticated attackers can leverage CVE-2012-4393 (an unrelated vulnerability) to obtain authenticated access and then exploit this issue [1].

Impact

Successful exploitation allows an attacker to modify app configurations, potentially leading to data manipulation, privilege escalation, or further compromise of the ownCloud instance. The exact impact depends on the configuration data being modified.

Mitigation

Fixed in ownCloud 4.0.6 as per the official changelog [4]. The commit [3] shows the addition of an admin user check in appconfig.php, which resolves the access restriction. Users should upgrade to version 4.0.6 or later.