DEV Community

kozhevniko
kozhevniko

Posted on

152,655 Matches for ownCloud and the CVE That Matches It Exactly

#security #zoomeye #attacksurface

152,655 Matches for ownCloud and the CVE That Matches It Exactly

When a product query and a CVE filter return the same number

CVE-2023-49105 is an authentication bypass in ownCloud core before 10.13.1, added to CISA's Known Exploited Vulnerabilities catalog on 27 August 2026. Two ZoomEye queries ran on 24 September 2026 with sub_type=all and a page size of one.
app="ownCloud" returned 152,655 matches. vul.cve="CVE-2023-49105" also returned 152,655.

What identical counts mean

Two different queries returning the same total is unusual and worth examining. It suggests that the CVE index and the product fingerprint resolve to the same asset set in ZoomEye's data, so the CVE-linked population for this flaw is essentially the whole identified ownCloud population.
That reading should be treated carefully. A vul.cve result indicates assets associated with the vulnerability in the index, which is not the same as a confirmed exploitable host. The number tells the reader that the two views overlap entirely, not that every instance is vulnerable.
The scale is the more actionable fact. A six-figure population of file synchronization servers is consistent with a flaw that returned to the exploited catalog three years after disclosure. File sync platforms are long-lived, frequently exposed for remote work, and often inherited by teams that did not choose them.

Why this flaw rewards reachable, unmaintained instances

The mechanism is a validation gap. Pre-signed URLs were accepted even when no signing key was configured for the file owner, so a known username was enough to read, modify or delete another account's files.
Neither precondition is exotic. Usernames surface in login pages, email addresses and public documents. The absence of a signing key is a configuration state that does not change unless someone changes it. Together they explain why an unpatched instance stays exploitable for years.

What to do with the measurement

Upgrade to ownCloud 10.13.1 or later, and configure a signing key for every file owner regardless of version, since the setting is both the workaround and a permanent requirement. Review WebDAV access logs for pre-signed URL requests that do not correspond to a legitimate share; those requests may carry no user identity, which is itself the signal.
Audit file integrity for the exposed period, and check for standing access added during it, including new shares and application passwords that survive a password reset.
Re-measure your own ranges. For a flaw with a five-year window between disclosure and exploitation, a persistent fingerprint match in your address space is a strong indicator of an installation nobody has reviewed.

Notes on scope and method

Queries: app="ownCloud" and vul.cve="CVE-2023-49105". Collection time: 2026-09-24 02:36 UTC. Scope: all asset types, page size 1. Both returned 152,655 matches. A CVE-index match is not a confirmed vulnerable host.

References

Top comments (0)