CVE-2019-25337
Username Enumeration in OwnCloud 8.1.8 via share.php Endpoint
Publication date: 2026-02-12
Last updated on: 2026-02-13
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| owncloud | owncloud | 8.1.8 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-203 | The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in OwnCloud version 8.1.8 and is a username enumeration flaw. It allows remote attackers to discover valid user accounts by sending specially crafted GET requests to the share.php endpoint. By manipulating the search parameter with a wildcard, attackers can retrieve detailed user information.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of user account information. Attackers can enumerate usernames remotely without authentication, which can be leveraged for further attacks such as phishing, brute force password attempts, or social engineering.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending crafted GET requests to the /index.php/core/ajax/share.php endpoint with a wildcard search parameter to see if user information is returned.
For example, you can use the following curl command to test for username enumeration:
- curl -v "http://<owncloud-server>/index.php/core/ajax/share.php?search=*"
If the response contains user account information, it indicates the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
I don't know