CVE-2015-4715: 
ownCloud vulnerability analysis and mitigation

CVE-2015-4715 is a security vulnerability discovered in the fetch function within OAuth/Curl.php in Dropbox-PHP, specifically affecting ownCloud Server versions before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted. The vulnerability was identified in June 2015 (CVE Details).

The vulnerability exists in the fetch function of OAuth/Curl.php component, where remote administrators of Dropbox.com could potentially read arbitrary files through the exploitation of an @ (at sign) character in unspecified POST values. The issue stems from improper handling of file references in POST requests (CVE Details).

When successfully exploited, this vulnerability allows remote administrators of Dropbox.com to read arbitrary files from the affected ownCloud server installations that have external Dropbox storage mounted (CVE Details).

The vulnerability was addressed through a security patch that adds validation to prevent handling of files containing an @ character. Users should upgrade to ownCloud Server versions 6.0.8, 7.0.6, or 8.0.4 or later to mitigate this vulnerability (Github Commit).