ownCloud < 10.7 Information Disclosure Vulnerability

ownCloud is prone to an information disclosure vulnerability.

The sharing dialog implements a user enumeration mitigation to prevent an authenticated user from getting a list of all accounts registered on the instance via the auto-complete dropdown. In the default configuration at least 3 characters of the name or email of the share-receiver ('Sharee') must match an existing account to trigger the autocomplete. Due to a bug in the related api endpoint the attacker can enumerate all users in a single request by entering three whitespaces. Secondary the retrieval of all users on a large instance could cause higher than average load on the instance.

ownCloud version 10.6 and probably prior.

Checks if a vulnerable version is present on the target host.

Update to version 10.7 or later.