VYPR
Get started
← All advisories
Low severity3.7NVD Advisory· Published Mar 3, 2017· Updated May 13, 2026

CVE-2017-5865

CVE-2017-5865

Description

The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows remote attackers to enumerate user names via a large number of password reset attempts.

Affected products

18
  • OwnCloud/Owncloud18 versions
    cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*+ 17 more
    • cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*range: <=8.1.10
    • cpe:2.3:a:owncloud:owncloud:8.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:8.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:8.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:8.2.5:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:8.2.6:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:8.2.7:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:8.2.8:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:9.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:9.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:9.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:9.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:9.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:9.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:9.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:9.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:9.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:owncloud:owncloud:9.1.2:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

2

News mentions

0

No linked articles in our index yet.