Description

The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows remote attackers to enumerate user names via a large number of password reset attempts.

Remediation

References

CVE-2017-5865

Related Vulnerabilities

Apache HTTP Server Out-of-bounds Write Vulnerability (CVE-2019-10081)

WordPress Plugin Variation Swatches for WooCommerce Cross-Site Scripting (1.0.61)

WordPress Plugin OPS Old Post Spinner 'ops_file' Parameter Local File Include (2.2.1)

MySQL CVE-2013-5894 Vulnerability (CVE-2013-5894)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-7134)

Severity

Low

Classification

CVE-2017-5865 CWE-200 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities