CVE-2020-28644

—

CVSS 3.1

4.3 medium

EPSS

<1%p39

Published

Feb 9, 2021 (Feb 9, 2021)

Modified

Jun 17, 2026

Description

The CSRF (Cross Site Request Forgery) token check was improperly implemented on cookie authenticated requests against some ocs API endpoints. This affects ownCloud/core version < 10.6.

Vendors: owncloud
Products: owncloud
Weakness: CWE-352
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.