{"id":"CVE-2017-5865","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-5865","generatedAt":"2026-10-28T21:57:08.056Z","title":"The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows remote attackers to enumerate user…","description":"The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows remote attackers to enumerate user names via a large number of password reset attempts.","published":"2017-03-03T15:59:01.000Z","lastModified":"2026-06-17T01:21:21.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":3.7,"severity":"LOW","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-200"],"affected":["owncloud/owncloud"],"epss":{"score":0.01095,"percentile":0.65372,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.09%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/96425","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://owncloud.org/security/advisory/?id=oc-sa-2017-001","tags":["Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/96425","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://owncloud.org/security/advisory/?id=oc-sa-2017-001","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-5865","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}