Home / Vulnerability Intelligence / CVE-2019-25337

CVE-2019-25337 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: February 13, 2026

OwnCloud - Username Enumeration

Published: February 12, 2026Updated: February 13, 2026Remote Exploitable

Overview

OwnCloud 8.1.8 contains a username enumeration vulnerability caused by manipulation of the share.php endpoint, letting remote attackers discover user accounts by sending crafted GET requests with wildcard search parameters.

Severity & Score

Severity: Critical

CVSS Score: 9.8

Impact

Remote attackers can discover valid usernames, aiding further targeted attacks or social engineering.

Mitigation

Update to the latest version of OwnCloud.

References

https://ftp.icm.edu.pl/packages/owncloud/
https://owncloud.org/
https://www.exploit-db.com/exploits/47745
https://www.vulncheck.com/advisories/owncloud-username-disclosure

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2019-25337
Severity: Critical
CVSS Score: 9.8
Type: broken_authentication
Status: unconfirmed

CWE

CWE-203

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H