PT-2017-16718 · Owncloud · Owncloud Server

Published 2017-03-03 · Updated 2017-03-08 · CVE-2017-5865

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 8.1.11 ownCloud Server versions 8.2.x prior to 8.2.9 ownCloud Server versions 9.0.x prior to 9.0.7 ownCloud Server versions 9.1.x prior to 9.1.3

Description The password reset functionality in ownCloud Server has an issue where it sends different error messages depending on whether the username is valid. This allows remote attackers to enumerate user names via a large number of password reset attempts.

Recommendations For ownCloud Server versions prior to 8.1.11, update to version 8.1.11 or later. For ownCloud Server versions 8.2.x prior to 8.2.9, update to version 8.2.9 or later. For ownCloud Server versions 9.0.x prior to 9.0.7, update to version 9.0.7 or later. For ownCloud Server versions 9.1.x prior to 9.1.3, update to version 9.1.3 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-5865

Affected Products

Owncloud Server

References · 5

• https://owncloud.org/security/advisory/?id=oc-sa-2017-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5865 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5865 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5865 · Note
• http://securityfocus.com/bid/96425 · Note