CVE-2017-5865: Infoleak
First published: Fri Mar 03 2017(Updated: )
The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows remote attackers to enumerate user names via a large number of password reset attempts.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ownCloud | <=8.1.10 | |
| ownCloud | =8.2.2 | |
| ownCloud | =8.2.3 | |
| ownCloud | =8.2.4 | |
| ownCloud | =8.2.5 | |
| ownCloud | =8.2.6 | |
| ownCloud | =8.2.7 | |
| ownCloud | =8.2.8 | |
| ownCloud | =9.0.0 | |
| ownCloud | =9.0.1 | |
| ownCloud | =9.0.2 | |
| ownCloud | =9.0.3 | |
| ownCloud | =9.0.4 | |
| ownCloud | =9.0.5 | |
| ownCloud | =9.0.6 | |
| ownCloud | =9.1.0 | |
| ownCloud | =9.1.1 | |
| ownCloud | =9.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-5865?
CVE-2017-5865 is considered a medium severity vulnerability due to the potential for user enumeration.
How do I fix CVE-2017-5865?
To fix CVE-2017-5865, upgrade to ownCloud Server versions 8.1.11, 8.2.9, 9.0.7, or 9.1.3 or later.
What systems are affected by CVE-2017-5865?
CVE-2017-5865 affects ownCloud Server versions prior to 8.1.11, 8.2.x before 8.2.9, and 9.0.x and 9.1.x before their respective updates.
What type of attack does CVE-2017-5865 enable?
CVE-2017-5865 enables remote attackers to perform user enumeration through the password reset functionality.
What could be the impact of CVE-2017-5865?
The impact of CVE-2017-5865 includes the potential exposure of usernames, which can lead to targeted attacks.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/remedy
- agent/author
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/owncloud
- canonical/owncloud
- version/owncloud/8.1.10
- version/owncloud/8.2.2
- version/owncloud/8.2.3
- version/owncloud/8.2.4
- version/owncloud/8.2.5
- version/owncloud/8.2.6
- version/owncloud/8.2.7
- version/owncloud/8.2.8
- version/owncloud/9.0.0
- version/owncloud/9.0.1
- version/owncloud/9.0.2
- version/owncloud/9.0.3
- version/owncloud/9.0.4
- version/owncloud/9.0.5
- version/owncloud/9.0.6
- version/owncloud/9.1.0
- version/owncloud/9.1.1
- version/owncloud/9.1.2