Information disclosure in email field dialog at sharing - ownCloud

An attacker can get sensitive information in the E-Mail share dialog with the autocompletion by default

Affected Software

• ownCloud Server < 9.1.3 (CVE-2017-5866)
  • core/c27b2b935f940a2c8e2fc1a5d8934407ae85dd57
• ownCloud Server < 9.0.7 (CVE-2017-5866)
  • core/62b1865a301a1ce90f9a3c773f5eb00c33deb581
• ownCloud Server < 8.2.9 (CVE-2017-5866)
  • core/1b3cef677940286693976aefc49ac5eb7b2e3180
• ownCloud Server < 8.1.11 (CVE-2017-5866)
  • core/13bd433cd607b678d4765a6c241c24ba2f03c89d

Action Taken

Add a new option for autocomplete E-Mail Share dialog

Acknowledgements

The ownCloud team thanks the following people for their research and responsible disclosure of the above advisory:

• xshadow - Vulnerability discovery and disclosure.