CVE-2017-5865
Status: ModifiedLow (3.7)—
The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows remote attackers to enumerate user names via a large number of password reset attempts.
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Base score: 3.7
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.09%
- Percentile among all scored CVEs: 64
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-200
References
Raw JSON (NVD)
Show
{
"id": "CVE-2017-5865",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 3.7,
"attackVector": "NETWORK",
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 2.2
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2017-03-03T15:59:01.320",
"references": [
{
"url": "http://www.securityfocus.com/bid/96425",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "cve@mitre.org"
},
{
"url": "https://owncloud.org/security/advisory/?id=oc-sa-2017-001",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/96425",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://owncloud.org/security/advisory/?id=oc-sa-2017-001",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows remote attackers to enumerate user names via a large number of password reset attempts."
},
{
"lang": "es",
"value": "La funcionalidad de reestablecimiento de contraseña en ownCloud Server en versiones anteriores a 8.1.11, 8.2.x en versiones anteriores a 8.2.9, 9.0.x en versiones anteriores a 9.0.7 y 9.1.x en versiones anteriores a 9.1.3 envía diferentes mensajes de error dependiendo de si el nombre de usuario es válido, lo que permite a atacantes remotos enumerar nombres de usuario a través de un gran número de intentos de reestablecimiento de contraseña."
}
],
"lastModified": "2026-06-17T01:21:20.730",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4E2EB67F-2620-434E-9AB5-45293C019F3F",
"versionEndIncluding": "8.1.10"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:8.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7C35E22D-36A5-495B-8611-7C8B70064A2E"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:8.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9FBDBB20-B519-4683-BB16-63A25AE53D7E"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:8.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "67AD973F-F06D-46C9-85EB-3521899A257B"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:8.2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8098FF20-D5EA-4F72-A837-0CE7B9761974"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:8.2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0930807A-BA26-4AFF-9B52-EC2EAF5A456D"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:8.2.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F81CD71B-7D08-485B-9042-D4CE523FEE80"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:8.2.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6FC26723-FE1F-4C1A-AF9C-901A1A7A4DA3"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:9.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25185B4F-623B-45F5-97C3-A520C96B6CA6"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:9.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8F31B84D-7A81-426C-8C91-BF86087ED657"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:9.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8CF3111-74DA-4644-9318-4D5CC6FBD1CC"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:9.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D52C26E1-C1A1-4834-84C5-C4403E1734D2"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:9.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "377EE3A2-8105-4448-AB9E-C703513CA6CD"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:9.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ADF1A811-E3EF-4A4A-8F7A-C3E5DBC24159"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:9.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ECEB63FC-724C-4FA5-A998-4549A2460A92"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:9.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8E74BD31-5BD3-40FE-93BA-CAE23DA681B2"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:9.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "32D138CF-6623-4E1E-97DC-6DD96FE62C1E"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:9.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "578DA4AF-C61B-4796-B5BF-89701D3FB8CB"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}