The SFTP external storage driver (files_external) in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5341
Reference (s):
- https://owncloud.org/security/advisory/?id=oc-sa-2014-019