4 ms·

So, if we ignore all lower and medium severity ones we're basically only left with CVE-2015-2213 which requires authentication. Also XSS is barely something one

So, if we ignore all lower and medium severity ones we're basically only left with CVE-2015-2213 which requires authentication. Also XSS is barely something one can blame PHP for. That's pretty low number. For the record: ownCloud protects you against XSS using Content-Security-Policy.

zurn 11y ago
The one column at the link with that has "medium" and "low" values is "complexity" which means CVSS's "access complexity". So having many rows like this means there are many vulnerabilities that are easy to exploit! Also CVE-2015-2213 is marked as NOT requiring authentication (along with about 7 other straight remote code execution CVEs).
- LukasReschke 11y ago
  > The one column at the link with that has "medium" and "low" values is "complexity" which means CVSS's "access complexity". So it means there are many vulnerabilities that are easy to exploit. I'm aware of that, I have a ton of CVE entries filed myself. I was referring to the score (https://nvd.nist.gov/cvss.cfm https://nvd.nist.gov/cvss.cfm), anything below 7.0 is not deemed "high". > Also CVE-2015-2213 is marked as NOT requiring authentication (along with about 7 other straight remote code execution CVEs). CVE entries are often terribly done wrong if they are not provided by the vendor (which is what ownCloud does). See https://core.trac.wordpress.org/changeset/33555 https://core.trac.wordpress.org/changeset/33555 for the patch for CVE-2015-2213. As you can see this is within the function "wp_untrash_post_comments" which is called by "wp_untrash_post" which only accepts user-input from the Wordpress admin panel.
  - fulafel 11y ago
    There are still 4 CVEs there with CVSS score > 7.0. There's really no reason to discount bugs based on having score < 7 though, it's a very rough measure and as you say not very reliable.
jessedhillon 11y ago
This is an arbitrary wishfulness. I'm not even sure why you're debating Wordpress vulnerabilities -- if your point is that PHP is a secure application development environment, then even if WP was riddled with 9.0 severity exploits, it shouldn't matter. It seems to me that by correlating your product's security with WP's, solely because they are both PHP apps, is conceding the ponit.

zurn 11y ago

The one column at the link with that has "medium" and "low" values is "complexity" which means CVSS's "access complexity". So having many rows like this means there are many vulnerabilities that are easy to exploit! Also CVE-2015-2213 is marked as NOT requiring authentication (along with about 7 other straight remote code execution CVEs).

LukasReschke 11y ago
> The one column at the link with that has "medium" and "low" values is "complexity" which means CVSS's "access complexity". So it means there are many vulnerabilities that are easy to exploit. I'm aware of that, I have a ton of CVE entries filed myself. I was referring to the score (https://nvd.nist.gov/cvss.cfm https://nvd.nist.gov/cvss.cfm), anything below 7.0 is not deemed "high". > Also CVE-2015-2213 is marked as NOT requiring authentication (along with about 7 other straight remote code execution CVEs). CVE entries are often terribly done wrong if they are not provided by the vendor (which is what ownCloud does). See https://core.trac.wordpress.org/changeset/33555 https://core.trac.wordpress.org/changeset/33555 for the patch for CVE-2015-2213. As you can see this is within the function "wp_untrash_post_comments" which is called by "wp_untrash_post" which only accepts user-input from the Wordpress admin panel.
- fulafel 11y ago
  There are still 4 CVEs there with CVSS score > 7.0. There's really no reason to discount bugs based on having score < 7 though, it's a very rough measure and as you say not very reliable.

jessedhillon 11y ago

This is an arbitrary wishfulness. I'm not even sure why you're debating Wordpress vulnerabilities -- if your point is that PHP is a secure application development environment, then even if WP was riddled with 9.0 severity exploits, it shouldn't matter. It seems to me that by correlating your product's security with WP's, solely because they are both PHP apps, is conceding the ponit.