CVE-2017-5865: Infoleak
The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows remote attackers to enumerate user names via a large number of password reset attempts.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5865?
CVE-2017-5865 is considered a medium severity vulnerability due to the potential for user enumeration.
How do I fix CVE-2017-5865?
To fix CVE-2017-5865, upgrade to ownCloud Server versions 8.1.11, 8.2.9, 9.0.7, or 9.1.3 or later.
What systems are affected by CVE-2017-5865?
CVE-2017-5865 affects ownCloud Server versions prior to 8.1.11, 8.2.x before 8.2.9, and 9.0.x and 9.1.x before their respective updates.
What type of attack does CVE-2017-5865 enable?
CVE-2017-5865 enables remote attackers to perform user enumeration through the password reset functionality.
What could be the impact of CVE-2017-5865?
The impact of CVE-2017-5865 includes the potential exposure of usernames, which can lead to targeted attacks.