Cyber Resilience

CVE-2019-25337

Public PoC
Published
12 February 2026
Modified
15 April 2026
CVSS Score v4 5.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0041 33th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2019-25337 is a medium-severity Observable Discrepancy (CWE-203) vulnerability in Edu (inferred from references). Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2019-25337 is a username enumeration vulnerability in OwnCloud version 8.1.8. It affects the share.php endpoint, where remote attackers can discover valid user accounts by sending crafted GET requests to /index.php/core/ajax/share.php using a wildcard search parameter, which returns comprehensive user information. The vulnerability is classified under CWE-203 and has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility and lack of prerequisites.

Any unauthenticated remote attacker can exploit this vulnerability without privileges, user interaction, or special conditions. By manipulating the search parameter in the specified endpoint, attackers can enumerate valid usernames and retrieve detailed user data, potentially enabling further attacks such as targeted phishing, credential stuffing, or brute-force attempts against discovered accounts.

Advisories and related resources, including an exploit proof-of-concept on Exploit-DB (https://www.exploit-db.com/exploits/47745) and a VulnCheck advisory (https://www.vulncheck.com/advisories/owncloud-username-disclosure), provide further details. Official OwnCloud resources (https://owncloud.org/) and package archives (https://ftp.icm.edu.pl/packages/owncloud/) are referenced for potential patches or updates, though specific mitigation steps are outlined in those documents. The CVE was published on 2026-02-12.

EU & UK References

Vulnerability Data

OwnCloud 8.1.8 contains a username enumeration vulnerability that allows remote attackers to discover user accounts by manipulating the share.php endpoint. Attackers can send crafted GET requests to /index.php/core/ajax/share.php with a wildcard search parameter to retrieve comprehensive user information.

CWE(s)
CWE-203

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1087 Account Discovery Discovery
Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.
attack.mitre.org →
Why these techniques?

The vulnerability allows unauthenticated remote exploitation of a public-facing web application (T1190) to enumerate valid usernames and user information (T1087 Account Discovery).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-21510Shared CWE-203
CVE-2026-47011Shared CWE-203
CVE-2024-41335Shared CWE-203
CVE-2025-6011Shared CWE-203
CVE-2026-26895Shared CWE-203
CVE-2026-26315Shared CWE-203
CVE-2024-2408Shared CWE-203
CVE-2024-22647Shared CWE-203
CVE-2024-25190Shared CWE-203
CVE-2026-26185Shared CWE-203

Affected Assets

Edu
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-14 Permitted Actions Without Identification or Authentication
  • SC-14 Public Access Protections
  • AC-3 Access Enforcement
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-14 Permitted Actions Without Identification or Authentication good match
prevent

Limits permitted actions without identification or authentication, preventing unauthenticated access to the share.php endpoint for username enumeration.

SC-14 Public Access Protections good match
prevent

Implements protections on publicly accessible endpoints like share.php to block unauthorized disclosure of user information via crafted requests.

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations on the share.php endpoint, blocking unauthenticated requests that enumerate and disclose user accounts.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent observable response discrepancies via consistent error handling and timing.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.17 Clock synchronization none match
none

Accurate, synchronized timestamps reduce observable timing discrepancies that an attacker could exploit to infer sensitive information or distinguish between success and failure paths.

References