CVE-2020-36251

Vulnerability

The vulnerability resides in the group share deletion functionality of ownCloud Server versions before 10.3.0, specifically tested on 10.2.0. An attacker who has received non-administrative access to a group share can exploit improper privilege management (CWE-385) to delete the share for all group recipients, including the share owner. This occurs because the permission check does not adequately restrict deletion to the user's own share membership [1].

Exploitation

To exploit, the attacker must be a recipient of a group share (no administrative privileges required). The attacker navigates to the received share and uses the delete option. Due to the flawed permission check, the deletion request removes the share for the entire group, not just the attacker's own access. No special network position or user interaction beyond the attacker's own actions is needed [1].

Impact

Successful exploitation allows the attacker to remove the group share for all other recipients, effectively denying them access to the shared data. However, no data is permanently lost; the share can be re-created by the original owner. The impact is limited to availability (temporary denial of service) with low confidentiality and integrity impact, reflected in a CVSS base score of 3.5 [1].

Mitigation

The vulnerability is fixed in ownCloud Server version 10.3.0 by improving permission checks when deleting groups. Users should upgrade to 10.3.0 or later. No workarounds are provided in the available reference [1].