CVE-2019-25337
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2019-25337 is a medium-severity Observable Discrepancy (CWE-203) vulnerability in Edu (inferred from references). Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Discovery (T1087); ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to IA-6 (Authentication Feedback) and SI-11 (Error Handling) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2019-25337 is a username enumeration vulnerability in OwnCloud version 8.1.8. It affects the share.php endpoint, where remote attackers can discover valid user accounts by sending crafted GET requests to /index.php/core/ajax/share.php using a wildcard search parameter, which returns comprehensive user information. The vulnerability is classified under CWE-203 and has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility and lack of prerequisites.
Any unauthenticated remote attacker can exploit this vulnerability without privileges, user interaction, or special conditions. By manipulating the search parameter in the specified endpoint, attackers can enumerate valid usernames and retrieve detailed user data, potentially enabling further attacks such as targeted phishing, credential stuffing, or brute-force attempts against discovered accounts.
Advisories and related resources, including an exploit proof-of-concept on Exploit-DB (https://www.exploit-db.com/exploits/47745) and a VulnCheck advisory (https://www.vulncheck.com/advisories/owncloud-username-disclosure), provide further details. Official OwnCloud resources (https://owncloud.org/) and package archives (https://ftp.icm.edu.pl/packages/owncloud/) are referenced for potential patches or updates, though specific mitigation steps are outlined in those documents. The CVE was published on 2026-02-12.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19573
Vulnerability Data
OwnCloud 8.1.8 contains a username enumeration vulnerability that allows remote attackers to discover user accounts by manipulating the share.php endpoint. Attackers can send crafted GET requests to /index.php/core/ajax/share.php with a wildcard search parameter to retrieve comprehensive user information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Obscures authentication feedback so that success/failure differences are not observable to attackers.
Requires error messages to avoid revealing exploitable details, directly stopping observable response discrepancies.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent observable response discrepancies via consistent error handling and timing.