CVE-2017-5865 | BDVDB-2026-82292 Detail

Description#

The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows remote attackers to enumerate user names via a large number of password reset attempts.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://owncloud.org/security/advisory/?id=oc-sa-2017-001
http://www.securityfocus.com/bid/96425

Exploit#

No public exploit known

History#

Version 12017-03-03Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.