CVE-2020-28646: 
ownCloud Desktop App vulnerability analysis and mitigation

ownCloud Desktop Client before version 2.7 was discovered to have a DLL Injection vulnerability. The vulnerability, identified as CVE-2020-28646, allowed the desktop client to load development plugins from certain directories when they were present (Vendor Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-427 (Uncontrolled Search Path Element). The technical issue stems from the desktop client's behavior of loading development plugins from specific directories without proper validation (NVD).

The vulnerability could potentially allow an attacker to achieve high levels of confidentiality, integrity, and availability impacts on the affected system. The CVSS scoring indicates that successful exploitation could result in complete compromise of the system's confidentiality, integrity, and availability (NVD).

The vulnerability requires local access (AV:L) with low attack complexity (AC:L). No privileges are required (PR:N), but user interaction is necessary (UI:R). The scope is unchanged (S:U), meaning the impact is limited to the vulnerable component (NVD).

The vulnerability was addressed by only setting plugin search path in development builds. Users are advised to upgrade to ownCloud Desktop Client version 2.7 or later to mitigate this vulnerability (Vendor Advisory).