CVE-2025-59716

Katalog CVE

CVSS 5.3 · Medium EPSS 0,95%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada owncloud guests. Skor CVSS 3.1 5.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validation of the supplied token in showPasswordForm, the server responds differently when an e-mail address corresponds to a valid pending guest user rather than a non-existent user.

Rincian

Terbit di NVD

5 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-203: Observable Discrepancy

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/thesmartshadow/64ae0449e909174d0479a4f23657147f exploit · advisory pihak ketiga
• https://github.com/owncloud/guests product
• https://marketplace.owncloud.com/apps/guests product
• https://yeswehack.com/reports/411806 permissions required