CVE-2013-0301: ownCloud

Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users for requests that change the timezone via the timezone parameter.

Affected products

• ownCloud ownCloud: up to and including 4.0.11
• ownCloud ownCloud Server: version 3.0.0 only; version 3.0.1 only; version 3.0.2 only; version 3.0.3 only; version 4.0.0 only; version 4.0.1 only; …

Published 2014-03-14. Last modified 2026-06-16.