1 of 13

Empirical Security API

Empirical Security

Overview

Welcome to the Empirical Security API. APIs are at the core of what we do, and they are the primary and foundational way we communicate the insights our models generate to our customers.

Products

Global Models API

Empirical.Models.Global is our global model, as well as the underlying data that is used in the generation of that model. The outcome is a real time probability of exploitation, and the model uses the world's largest repository of exploitation activity on vulnerabilities as the outcome measure. We have data about over 16,000 actively exploited CVEs.

EPSS Models API

is enterprise support for our public (and free) model, EPSS. More information as well as the free API can be found on www.first.org/EPSS. Here, we provide hourly updates and support for legacy EPSS models.

Local Models API

Lastly, we build Locals models that are specific to enterprises. Reach out if you'd like to learn more: .

Legacy - Exploit Intelligence Service API

users can skip ahead to see the data dictionary for that product. We're no longer onboarding new users to EIS.

Authentication

Authentication to the Empirical API begins with a client ID and a client secret. Your organization can create as many ID/secret pairs as needed.

How Client Credentials Work

A client ID and secret pair need to be exchanged for a JWT from our auth provider. The exchange process is a POST to https://empiricalsecurity.fusionauth.io/oauth2/token, authenticated with HTTP Basic auth. Provide the client ID as the username and the client secret as the password. The POST request will need to include two values:

grant_type=client_credentials
scope=target-entity:0c6d5dcc-8bf0-4cd1-bd65-066ef0422369

The response to the POST request will be a JSON object and the JWT will be stored in the access_token key.

Empirical API requests should include an Authorization header with a value of Bearer <JWT>.

Your issued JWT is valid for one hour. A new JWT will need to be retrieved, using the same process, when the expiration time passes. The exp claim in the JWT contains the exact expiration time for the token.

How to Create API Clients

, go to Settings, and click "API Clients".
Choose an alias name and click "Create API Client".
Copy and save your Client Credentials.

The client secret will only be visible at the time of creation, so be sure to save it.

Search Syntax

The Empirical API allows you to search for CVEs using a standardized syntax.

Building Search Queries

Search queries are built from search terms, separated by spaces. Search terms are built from a key and a value, joined with a colon.

When used with the Search API the querystring portion must be URL-encoded. For example, cURL users can specify -G --data-urlencode "q=score:>90" as part of their command to correctly encode and append the search query.

The result of a search query are those CVEs that match all terms in the query. In other words, terms are combined using AND.

Supported Terms

Key

Value

Errors

Learn about how our API handles and returns errors

API Response Codes

Our API uses conventional HTTP response codes to indicate the success or failure of API requests. In general:

Codes in the 2xx range indicate success
Codes in the 4xx range indicate errors that failed given the information provided
Codes in the 5xx range indicate errors with our servers

Error Response Format

All error responses follow a consistent format:

Attributes

code - A string identifier that indicates the specific type of error that occurred
message - A human-readable message providing more details about the error

Error Code

Description

Examples

Authentication Error (HTTP 401)

Resource Not Found (HTTP 404)

Internal Server Error (HTTP 500)

Products

Empirical.Models.Global

Data Dictionary

The Empirical.Models.Global API provides comprehensive, real-time security insights across a vast range of global vulnerabilities and threats. Designed for enterprise security teams, this API enables users to access critical data on known vulnerabilities and exploits, as well as exploitation probabilities empowering organizations to make faster, data-driven decisions to protect their assets.

With predictive scoring powered by machine learning, the API offers an accurate view of exploit likelihood through the Exploit Prediction Scoring System (EPSS). Users have access to historical and near-real time data about CVE details, CPE information, exploits, and historical exploitation data—giving a granular understanding of vulnerability risk and the data provenance to have confidence in the decisions the API enables.

Data Dictionary

Scoring

global

Empirical scores are generated from our Global Model and updated hourly.

empirical_score float (ex. 0.9713943314711305)

empirical_percentile float (ex. 0.9713943314711305)

computed_at datetime (ex. 2025-03-16 18:46:04 UTC)

epss_v4

Empirical Security generates the EPSS scores that are served from first.org. In our enterprise API, we update the scores hourly rather than daily.

epss_score float (ex. 0.9713943314711305)

epss_percentile float (ex. 0.9713943314711305)

computed_at datetime (ex. 2025-03-16 18:46:04 UTC)

epss_v3

Empirical Security generates the EPSS scores that are served from first.org. In our enterprise API, we update the scores hourly rather than daily

epss_score float (ex. 0.9713943314711305)

epss_percentile float (ex. 0.9713943314711305)

computed_at datetime (ex. 2025-03-16 18:46:04 UTC)

Retrieve the entire score history for the CVE. Supported scoring_model values are global epss_v3 epss_v4 all

CVE Data

identifier

CVE ID assigned to a vulnerability

string (ex. "CVE-2023-49103")

description

Text summary describing the CVE ID referenced by the identifier.

string (ex. "An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1")

reserved_at

datetime (ex. "2023-11-21T00:00:00.000Z")

published_at

datetime (ex. "2023-11-21T00:00:00.000Z")

last_updated_at

datetime (ex. "2025-01-27T22:24:27.772Z")

recently_updated

Returns CVEs with updated information and/or any score change greater than 0.0001 within the selected date range.

past_day boolean CVE data has been updated in the last 24 hours

past_week boolean CVE data has been updated in the last 7 days

past_month boolean CVE data has been updated in the last 30 days

cisa_kev_added_at

datetime (ex. "2023-11-30T00:00:00.000Z")

vendor

The name of the software vendor responsible for the affected software. Spaces in vendor names should be replaced with underscores. string (ex. "google")

product

The name of the affected software product. Spaces in product names should be replaced with underscores. string (ex. "chrome_os")

tags

Empirical Security generated metadata relevant to the CVE ID

actor string

actor_action string

attack_vector string (ex. "Network")

component

references

Discovered links associated with the CVE ID referenced by the identifier.

url

shodan_vulnerability_count

integer (ex. "4")

hackerone_reports_submitted

integer (ex. "4")

google_project_zero

present boolean (ex. "false")

patched_at datetime (ex. "null")

Provides all malware hashes associated with the given CVE identifier.

md5 integer

sha1 integer

sha256 string

Exploitation Activity and Exploits Data

has_exploitation_activity

Secondary source reporting of exploitation (DHS CISA, threat intel blogs, etc) is a useful but incomplete picture of exploitation activity. Our Exploitation Activity data answers the deeper questions about exploitation by measuring actual events and reporting primary source information. This data comes from aggregated sources, and includes malware and network detections. These observations are repeatable, systematic, and represent a much better guide for action.

boolean (ex. true)

exploitation_activity

Mutually exclusive time buckets ensure that data points are not double-counted or misallocated, and we wanted to prevent a single exploitation activity from making multiple categories light up, creating an inaccurate perception of activity volume.

0_to_7_days boolean Days with exploitation activity in the last 7 days

8_to_30_days boolean Any exploitation activity in the last month excluding the last 7 days

31_to_90_days boolean Any exploitation activity in the last 90 days excluding the last 30

exploit_code

Returns CVEs with any discovered exploit code links detected (ex. GitHub Repository Links).

boolean (ex. true)

exploits

Exploit Code is discovered using our proprietary machine learning model, a binary classifier to crawl GitHub and determine if a repository is an exploit or just a mention of a CVE. The model discovers new exploit code daily, and a repository crosses our model threshold, we include it here. Additional exploit code is included if we find it in the plethora of other sources we purchase or scrape.

metasploit See below for examples

exploitdb See below for examples

github See below for examples

metasploit

Exploits data includes:

name string (ex. "ownCloud Phpinfo Reader")

fullname string (ex. "uxiliary/gather/owncloud_phpinfo_reader")

description string

disclosure_date

github

Exploits data includes:

repo string (ex. "d0rb/CVE-2023-49103")

prediction float (ex. 0.8660581707954407)

predicted_at datetime (ex. 2025-03-10T16:40:29.000Z)

repo_created_at

exploitdb

Exploits data includes:

url url

published_on datetime (ex. "2018-08-03")

author string (ex. "Mark Corrigan")

platform

CVSS and CWE Data

CVSS

Common Vulnerability Scoring System data (only 4.0 and 3.1 vectors are supported)

version integer (ex. 3.1)

score integer (ex. 10.0)

vector string (ex. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

metrics

CVSS data includes:

attack_vector string (ex. "Network")

attack_complexity string (ex. "Low")

privileges_required string (ex. "None")

user_interaction

sources

CVSS data includes:

string (ex. ["[email protected]", "mitre"])

cwes

Common Weakness Enumeration data

identifier string (ex. "CWE-200")

name string ("Exposure of Sensitive Information to an Unauthorized Actor")

description string (ex. "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.")

API Response Example

Empirical.Models.EPSS

Data Dictionary

The Empirical.Models.EPSS API provides real-time updates and an accurate view of exploit likelihood through the Exploit Prediction Scoring System (EPSS). Users have access to EPSS scores updated hourly, support for legacy versions of EPSS (v3) as well as the newest version.

EPSS Users only receive this smaller subset of data. Examples are shown below.

Data Dictionary

Exploit Prediction Scoring Data

epss_v4

Empirical Security generates the EPSS scores that are served from first.org. In our enterprise API, we update the scores hourly rather than daily.

epss_score float (ex. 0.9713943314711305)

epss_percentile float (ex. 0.9713943314711305)

computed_at datetime (ex. 2025-03-16 18:46:04 UTC)

epss_v3

Empirical Security generates the EPSS scores that are served from first.org. In our enterprise API, we update the scores hourly rather than daily

epss_score float (ex. 0.9713943314711305)

epss_percentile float (ex. 0.9713943314711305)

computed_at datetime (ex. 2025-03-16 18:46:04 UTC)

CVE Data

identifier

CVE ID assigned to a vulnerability

string (ex. "CVE-2023-49103")

description

Text summary describing the CVE ID referenced by the identifier.

string (ex. "An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1")

reserved_at

datetime (ex. "2023-11-21T00:00:00.000Z")

published_at

datetime (ex. "2023-11-21T00:00:00.000Z")

recently_updated

Returns CVEs with updated information and/or any score change greater than 0.0001 within the selected date range.

past_day boolean CVE data has been updated in the last 24 hours

past_week boolean CVE data has been updated in the last 7 days

past_month boolean CVE data has been updated in the last 30 days

vendor

The name of the software vendor responsible for the affected software. Spaces in vendor names should be replaced with underscores. string (ex. "google")

product

The name of the affected software product. Spaces in product names should be replaced with underscores. string (ex. "chrome_os")

CVSS and CWE Data

CVSS

Common Vulnerability Scoring System data (only 4.0 and 3.1 vectors are supported)

version integer (ex. 3.1)

score integer (ex. 10.0)

vector string (ex. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

metrics

CVSS data includes:

attack_vector string (ex. "Network")

attack_complexity string (ex. "Low")

privileges_required string (ex. "None")

user_interaction

sources

CVSS data includes:

string (ex. ["[email protected]", "mitre"])

cwes

Common Weakness Enumeration data

identifier string (ex. "CWE-200")

name string ("Exposure of Sensitive Information to an Unauthorized Actor")

description string (ex. "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.")

API Response Example

Legacy - Exploit Intelligence Service

Data Dictionary

Our legacy product, the Exploit Intelligence Service (EIS), generates a json file including the following fields. Reach out if you are a user of EIS and we will help you transition your workflows to the new API.

Data Dictionary

Field Name

Data Type

Description

Notes

API References

CVEs

Search

Search queries are submitted using Empirical's search syntax.

Saved Queries

Empirical.Models.EPSS

Data Dictionary

EPSS Users only receive this smaller subset of data. Examples are shown below.

Data Dictionary

Exploit Prediction Scoring Data

epss_v4

Empirical Security generates the EPSS scores that are served from first.org. In our enterprise API, we update the scores hourly rather than daily.

epss_score float (ex. 0.9713943314711305)

epss_percentile float (ex. 0.9713943314711305)

computed_at datetime (ex. 2025-03-16 18:46:04 UTC)

epss_v3

Empirical Security generates the EPSS scores that are served from first.org. In our enterprise API, we update the scores hourly rather than daily

epss_score float (ex. 0.9713943314711305)

epss_percentile float (ex. 0.9713943314711305)

computed_at datetime (ex. 2025-03-16 18:46:04 UTC)

CVE Data

identifier

CVE ID assigned to a vulnerability

string (ex. "CVE-2023-49103")

description

Text summary describing the CVE ID referenced by the identifier.

string (ex. "An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1")

reserved_at

datetime (ex. "2023-11-21T00:00:00.000Z")

published_at

datetime (ex. "2023-11-21T00:00:00.000Z")

recently_updated

Returns CVEs with updated information and/or any score change greater than 0.0001 within the selected date range.

past_day boolean CVE data has been updated in the last 24 hours

past_week boolean CVE data has been updated in the last 7 days

past_month boolean CVE data has been updated in the last 30 days

vendor

The name of the software vendor responsible for the affected software. Spaces in vendor names should be replaced with underscores. string (ex. "google")

product

The name of the affected software product. Spaces in product names should be replaced with underscores. string (ex. "chrome_os")

CVSS and CWE Data

CVSS

Common Vulnerability Scoring System data (only 4.0 and 3.1 vectors are supported)

version integer (ex. 3.1)

score integer (ex. 10.0)

vector string (ex. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

metrics

CVSS data includes:

attack_vector string (ex. "Network")

attack_complexity string (ex. "Low")

privileges_required string (ex. "None")

user_interaction

sources

CVSS data includes:

string (ex. ["[email protected]", "mitre"])

cwes

Common Weakness Enumeration data

identifier string (ex. "CWE-200")

name string ("Exposure of Sensitive Information to an Unauthorized Actor")

description string (ex. "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.")

API Response Example

Empirical.Models.Global

Data Dictionary

Scoring

global

Empirical scores are generated from our Global Model and updated hourly.

empirical_score float (ex. 0.9713943314711305)

empirical_percentile float (ex. 0.9713943314711305)

computed_at datetime (ex. 2025-03-16 18:46:04 UTC)

epss_v4

Empirical Security generates the EPSS scores that are served from first.org. In our enterprise API, we update the scores hourly rather than daily.

epss_score float (ex. 0.9713943314711305)

epss_percentile float (ex. 0.9713943314711305)

computed_at datetime (ex. 2025-03-16 18:46:04 UTC)

epss_v3

Empirical Security generates the EPSS scores that are served from first.org. In our enterprise API, we update the scores hourly rather than daily

epss_score float (ex. 0.9713943314711305)

epss_percentile float (ex. 0.9713943314711305)

computed_at datetime (ex. 2025-03-16 18:46:04 UTC)

Retrieve the entire score history for the CVE. Supported scoring_model values are global epss_v3 epss_v4 all

CVE Data

identifier

CVE ID assigned to a vulnerability

string (ex. "CVE-2023-49103")

description

Text summary describing the CVE ID referenced by the identifier.

string (ex. "An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1")

reserved_at

datetime (ex. "2023-11-21T00:00:00.000Z")

published_at

datetime (ex. "2023-11-21T00:00:00.000Z")

last_updated_at

datetime (ex. "2025-01-27T22:24:27.772Z")

recently_updated

Returns CVEs with updated information and/or any score change greater than 0.0001 within the selected date range.

past_day boolean CVE data has been updated in the last 24 hours

past_week boolean CVE data has been updated in the last 7 days

past_month boolean CVE data has been updated in the last 30 days

cisa_kev_added_at

datetime (ex. "2023-11-30T00:00:00.000Z")

vendor

The name of the software vendor responsible for the affected software. Spaces in vendor names should be replaced with underscores. string (ex. "google")

product

The name of the affected software product. Spaces in product names should be replaced with underscores. string (ex. "chrome_os")

tags

Empirical Security generated metadata relevant to the CVE ID

actor string

actor_action string

attack_vector string (ex. "Network")

component

references

Discovered links associated with the CVE ID referenced by the identifier.

url

shodan_vulnerability_count

integer (ex. "4")

hackerone_reports_submitted

integer (ex. "4")

google_project_zero

present boolean (ex. "false")

patched_at datetime (ex. "null")

Provides all malware hashes associated with the given CVE identifier.

md5 integer

sha1 integer

sha256 string

Exploitation Activity and Exploits Data

has_exploitation_activity

boolean (ex. true)

exploitation_activity

0_to_7_days boolean Days with exploitation activity in the last 7 days

8_to_30_days boolean Any exploitation activity in the last month excluding the last 7 days

31_to_90_days boolean Any exploitation activity in the last 90 days excluding the last 30

exploit_code

Returns CVEs with any discovered exploit code links detected (ex. GitHub Repository Links).

boolean (ex. true)

exploits

metasploit See below for examples

exploitdb See below for examples

github See below for examples

metasploit

Exploits data includes:

name string (ex. "ownCloud Phpinfo Reader")

fullname string (ex. "uxiliary/gather/owncloud_phpinfo_reader")

description string

disclosure_date

github

Exploits data includes:

repo string (ex. "d0rb/CVE-2023-49103")

prediction float (ex. 0.8660581707954407)

predicted_at datetime (ex. 2025-03-10T16:40:29.000Z)

repo_created_at

exploitdb

Exploits data includes:

url url

published_on datetime (ex. "2018-08-03")

author string (ex. "Mark Corrigan")

platform

CVSS and CWE Data

CVSS

Common Vulnerability Scoring System data (only 4.0 and 3.1 vectors are supported)

version integer (ex. 3.1)

score integer (ex. 10.0)

vector string (ex. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

metrics

CVSS data includes:

attack_vector string (ex. "Network")

attack_complexity string (ex. "Low")

privileges_required string (ex. "None")

user_interaction

sources

CVSS data includes:

string (ex. ["[email protected]", "mitre"])

cwes

Common Weakness Enumeration data

identifier string (ex. "CWE-200")

name string ("Exposure of Sensitive Information to an Unauthorized Actor")

description string (ex. "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.")

API Response Example

{ "identifier": "CVE-2023-49103", "description": "An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo).", "cvss": [ { "version": "3.1", "score": 10.0, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "metrics": { "attack_vector": "Network", "attack_complexity": "Low", "privileges_required": "None", "user_interaction": "None", "scope": "Changed", "confidentiality": "High", "integrity": "High", "availability": "High" }, "sources": [ "[email protected]", "mitre" ] }, { "version": "3.1", "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "metrics": { "attack_vector": "Network", "attack_complexity": "Low", "privileges_required": "None", "user_interaction": "None", "scope": "Unchanged", "confidentiality": "High", "integrity": "None", "availability": "None" }, "sources": [ "[email protected]" ] } ], "references": [ "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/", "https://owncloud.org/security" ], "has_exploitation_activity": true, "exploitation_activity": { "0_to_7_days": true, "8_to_30_days": true, "31_to_90_days": true, "91_to_365_days": true, "alltime": true }, "tags": { "actor": [], "actor_action": [], "attack_vector": [], "component": [ "mail server credentials", "license key", "ownCloud admin password" ], "keywords": [ "information disclosure", "web", "configuration" ], "outcome": [ "credential disclosure", "gather information" ], "prerequisite": [ "URL is accessed" ], "stride": [ "tampering", "information disclosure", "denial of service" ], "weakness": [ "reveals the configuration details of the PHP environment", "exposes various other potentially sensitive configuration details" ] }, "cwes": [ { "identifier": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.", "category_name": "SFP Secondary Cluster: Exposed Data", "category_id": "CWE-963" } ], "reserved_at": "2023-11-21T00:00:00.000Z", "published_at": "2023-11-21T00:00:00.000Z", "last_updated_at": "2025-01-27T22:24:27.772Z", "cisa_kev_added_at": "2023-11-30T00:00:00.000Z", "shodan_vulnerability_count": null, "google_project_zero": { "present": false, "patched_at": null }, "exploits": { "metasploit": [ { "name": "ownCloud Phpinfo Reader", "fullname": "auxiliary/gather/owncloud_phpinfo_reader", "description": "Docker containers of ownCloud compiled after February 2023, which have version 0.2.0 before 0.2.1 or 0.3.0 before 0.3.1 of the app `graph` installed\n contain a test file which prints `phpinfo()` to an unauthenticated user. A post file name must be appended to the URL to bypass the login filter.\n Docker may export sensitive environment variables including ownCloud, DB, redis, SMTP, and S3 credentials, as well as other host information.", "disclosure_date": "2023-11-21", "mod_time": "2023-12-04T20:09:56.000Z" } ], "exploitdb": [], "github": [ { "repo": "d0rb/CVE-2023-49103", "prediction": 0.8660581707954407, "predicted_at": "2025-03-10T16:40:29.000Z", "repo_created_at": "2025-03-10T20:11:29.004Z" } ] }, "hackerone_reports_submitted": 4, "scores": { "epss_v4": { "score": 0.9091291982186883, "percentile": 0.996181146025878, "computed_at": "2025-03-16 18:46:04 UTC" }, "epss_v3": { "score": 0.92099, "percentile": 0.99238, "computed_at": "2025-03-16 15:46:16 UTC" }, "global": { "score": 0.9713943314711305, "percentile": 0.9998484036161284, "computed_at": "2025-03-16 07:27:24 UTC" } } }

[ { "identifier": "CVE-2023-49103", "description": "An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo).", "cvss": [ { "version": "3.1", "score": 10, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "metrics": { "attack_vector": "Network", "attack_complexity": "Low", "privileges_required": "None", "user_interaction": "None", "scope": "Changed", "confidentiality": "High", "integrity": "High", "availability": "High" }, "sources": [ "[email protected]", "mitre" ] }, { "version": "3.1", "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "metrics": { "attack_vector": "Network", "attack_complexity": "Low", "privileges_required": "None", "user_interaction": "None", "scope": "Unchanged", "confidentiality": "High", "integrity": "None", "availability": "None" }, "sources": [ "[email protected]" ] } ], "references": [ "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/", "https://owncloud.org/security" ], "has_exploitation_activity": true, "exploitation_activity": { "0_to_7_days": true, "8_to_30_days": true, "31_to_90_days": true, "91_to_365_days": true, "alltime": true }, "tags": { "actor": [], "actor_action": [], "attack_vector": [], "component": [ "mail server credentials", "license key", "ownCloud admin password" ], "keywords": [ "information disclosure", "web", "configuration" ], "outcome": [ "credential disclosure", "gather information" ], "prerequisite": [ "URL is accessed" ], "stride": [ "tampering", "information disclosure", "denial of service" ], "weakness": [ "reveals the configuration details of the PHP environment", "exposes various other potentially sensitive configuration details" ] }, "cwes": [ { "identifier": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.", "category_name": "SFP Secondary Cluster: Exposed Data", "category_id": "CWE-963" } ], "reserved_at": "2023-11-21T00:00:00.000Z", "published_at": "2023-11-21T00:00:00.000Z", "last_updated_at": "2025-01-27T22:24:27.772Z", "cisa_kev_added_at": "2023-11-30T00:00:00.000Z", "shodan_vulnerability_count": null, "google_project_zero": { "present": false, "patched_at": null }, "exploits": { "metasploit": [ { "name": "ownCloud Phpinfo Reader", "fullname": "auxiliary/gather/owncloud_phpinfo_reader", "description": "Docker containers of ownCloud compiled after February 2023, which have version 0.2.0 before 0.2.1 or 0.3.0 before 0.3.1 of the app `graph` installed\n contain a test file which prints `phpinfo()` to an unauthenticated user. A post file name must be appended to the URL to bypass the login filter.\n Docker may export sensitive environment variables including ownCloud, DB, redis, SMTP, and S3 credentials, as well as other host information.", "disclosure_date": "2023-11-21", "mod_time": "2023-12-04T20:09:56.000Z", "url": "https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/gather/owncloud_phpinfo_reader.rb" } ], "exploitdb": [], "github": [ { "repo": "d0rb/CVE-2023-49103", "prediction": 0.8660581707954407, "predicted_at": "2025-03-10T16:40:29.000Z", "repo_created_at": "2025-03-10T20:11:29.004Z", "url": "https://github.com/d0rb/CVE-2023-49103" } ] }, "hackerone_reports_submitted": 4, "scores": { "global": { "score": 0.9713943314711305, "percentile": 0.9998484036161284, "computed_at": "2025-03-16T07:27:24.000Z" }, "epss_v3": { "score": 0.92099, "percentile": 0.99238, "computed_at": "2025-03-16T15:46:16.000Z" }, "epss_v4": { "score": 0.9091291982186883, "percentile": 0.996181146025878, "computed_at": "2025-03-16T18:47:04.000Z" } }, "platforms": [ { "product": "product", "vendor": "vendor" } ], "most_recent_exploitation_activity_date": "2025-07-20", "exploitation_activity_source_count": 1, "replacement_cve": null } ]

{ "identifier": "CVE-2023-49103", "description": "An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo).", "cvss": [ { "version": "3.1", "score": 10, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "metrics": { "attack_vector": "Network", "attack_complexity": "Low", "privileges_required": "None", "user_interaction": "None", "scope": "Changed", "confidentiality": "High", "integrity": "High", "availability": "High" }, "sources": [ "[email protected]", "mitre" ] }, { "version": "3.1", "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "metrics": { "attack_vector": "Network", "attack_complexity": "Low", "privileges_required": "None", "user_interaction": "None", "scope": "Unchanged", "confidentiality": "High", "integrity": "None", "availability": "None" }, "sources": [ "[email protected]" ] } ], "references": [ "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/", "https://owncloud.org/security" ], "has_exploitation_activity": true, "exploitation_activity": { "0_to_7_days": true, "8_to_30_days": true, "31_to_90_days": true, "91_to_365_days": true, "alltime": true }, "tags": { "actor": [], "actor_action": [], "attack_vector": [], "component": [ "mail server credentials", "license key", "ownCloud admin password" ], "keywords": [ "information disclosure", "web", "configuration" ], "outcome": [ "credential disclosure", "gather information" ], "prerequisite": [ "URL is accessed" ], "stride": [ "tampering", "information disclosure", "denial of service" ], "weakness": [ "reveals the configuration details of the PHP environment", "exposes various other potentially sensitive configuration details" ] }, "cwes": [ { "identifier": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.", "category_name": "SFP Secondary Cluster: Exposed Data", "category_id": "CWE-963" } ], "reserved_at": "2023-11-21T00:00:00.000Z", "published_at": "2023-11-21T00:00:00.000Z", "last_updated_at": "2025-01-27T22:24:27.772Z", "cisa_kev_added_at": "2023-11-30T00:00:00.000Z", "shodan_vulnerability_count": null, "google_project_zero": { "present": false, "patched_at": null }, "exploits": { "metasploit": [ { "name": "ownCloud Phpinfo Reader", "fullname": "auxiliary/gather/owncloud_phpinfo_reader", "description": "Docker containers of ownCloud compiled after February 2023, which have version 0.2.0 before 0.2.1 or 0.3.0 before 0.3.1 of the app `graph` installed\n contain a test file which prints `phpinfo()` to an unauthenticated user. A post file name must be appended to the URL to bypass the login filter.\n Docker may export sensitive environment variables including ownCloud, DB, redis, SMTP, and S3 credentials, as well as other host information.", "disclosure_date": "2023-11-21", "mod_time": "2023-12-04T20:09:56.000Z", "url": "https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/gather/owncloud_phpinfo_reader.rb" } ], "exploitdb": [], "github": [ { "repo": "d0rb/CVE-2023-49103", "prediction": 0.8660581707954407, "predicted_at": "2025-03-10T16:40:29.000Z", "repo_created_at": "2025-03-10T20:11:29.004Z", "url": "https://github.com/d0rb/CVE-2023-49103" } ] }, "hackerone_reports_submitted": 4, "scores": { "global": { "score": 0.9713943314711305, "percentile": 0.9998484036161284, "computed_at": "2025-03-16T07:27:24.000Z" }, "epss_v3": { "score": 0.92099, "percentile": 0.99238, "computed_at": "2025-03-16T15:46:16.000Z" }, "epss_v4": { "score": 0.9091291982186883, "percentile": 0.996181146025878, "computed_at": "2025-03-16T18:47:04.000Z" } }, "platforms": [ { "product": "product", "vendor": "vendor" } ], "most_recent_exploitation_activity_date": "2025-07-20", "exploitation_activity_source_count": 1, "replacement_cve": null }

[ { "data": { "identifier": "CVE-2023-49103", "description": "An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo).", "cvss": [ { "version": "3.1", "score": 10, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "metrics": { "attack_vector": "Network", "attack_complexity": "Low", "privileges_required": "None", "user_interaction": "None", "scope": "Changed", "confidentiality": "High", "integrity": "High", "availability": "High" }, "sources": [ "[email protected]", "mitre" ] }, { "version": "3.1", "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "metrics": { "attack_vector": "Network", "attack_complexity": "Low", "privileges_required": "None", "user_interaction": "None", "scope": "Unchanged", "confidentiality": "High", "integrity": "None", "availability": "None" }, "sources": [ "[email protected]" ] } ], "references": [ "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/", "https://owncloud.org/security" ], "has_exploitation_activity": true, "exploitation_activity": { "0_to_7_days": true, "8_to_30_days": true, "31_to_90_days": true, "91_to_365_days": true, "alltime": true }, "tags": { "actor": [], "actor_action": [], "attack_vector": [], "component": [ "mail server credentials", "license key", "ownCloud admin password" ], "keywords": [ "information disclosure", "web", "configuration" ], "outcome": [ "credential disclosure", "gather information" ], "prerequisite": [ "URL is accessed" ], "stride": [ "tampering", "information disclosure", "denial of service" ], "weakness": [ "reveals the configuration details of the PHP environment", "exposes various other potentially sensitive configuration details" ] }, "cwes": [ { "identifier": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.", "category_name": "SFP Secondary Cluster: Exposed Data", "category_id": "CWE-963" } ], "reserved_at": "2023-11-21T00:00:00.000Z", "published_at": "2023-11-21T00:00:00.000Z", "last_updated_at": "2025-01-27T22:24:27.772Z", "cisa_kev_added_at": "2023-11-30T00:00:00.000Z", "shodan_vulnerability_count": null, "google_project_zero": { "present": false, "patched_at": null }, "exploits": { "metasploit": [ { "name": "ownCloud Phpinfo Reader", "fullname": "auxiliary/gather/owncloud_phpinfo_reader", "description": "Docker containers of ownCloud compiled after February 2023, which have version 0.2.0 before 0.2.1 or 0.3.0 before 0.3.1 of the app `graph` installed\n contain a test file which prints `phpinfo()` to an unauthenticated user. A post file name must be appended to the URL to bypass the login filter.\n Docker may export sensitive environment variables including ownCloud, DB, redis, SMTP, and S3 credentials, as well as other host information.", "disclosure_date": "2023-11-21", "mod_time": "2023-12-04T20:09:56.000Z", "url": "https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/gather/owncloud_phpinfo_reader.rb" } ], "exploitdb": [], "github": [ { "repo": "d0rb/CVE-2023-49103", "prediction": 0.8660581707954407, "predicted_at": "2025-03-10T16:40:29.000Z", "repo_created_at": "2025-03-10T20:11:29.004Z", "url": "https://github.com/d0rb/CVE-2023-49103" } ] }, "hackerone_reports_submitted": 4, "scores": { "global": { "score": 0.9713943314711305, "percentile": 0.9998484036161284, "computed_at": "2025-03-16T07:27:24.000Z" }, "epss_v3": { "score": 0.92099, "percentile": 0.99238, "computed_at": "2025-03-16T15:46:16.000Z" }, "epss_v4": { "score": 0.9091291982186883, "percentile": 0.996181146025878, "computed_at": "2025-03-16T18:47:04.000Z" } }, "platforms": [ { "product": "product", "vendor": "vendor" } ], "most_recent_exploitation_activity_date": "2025-07-20", "exploitation_activity_source_count": 1, "replacement_cve": null }, "diff": { "cvss": { "old": [ { "version": "3.1", "score": 10, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "metrics": { "attack_vector": "Network", "attack_complexity": "Low", "privileges_required": "None", "user_interaction": "None", "scope": "Changed", "confidentiality": "High", "integrity": "High", "availability": "High" }, "sources": [ "[email protected]", "mitre" ] } ], "new": [ { "version": "3.1", "score": 10, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "metrics": { "attack_vector": "Network", "attack_complexity": "Low", "privileges_required": "None", "user_interaction": "None", "scope": "Changed", "confidentiality": "High", "integrity": "High", "availability": "High" }, "sources": [ "[email protected]", "mitre" ] }, { "version": "3.1", "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "metrics": { "attack_vector": "Network", "attack_complexity": "Low", "privileges_required": "None", "user_interaction": "None", "scope": "Unchanged", "confidentiality": "High", "integrity": "None", "availability": "None" }, "sources": [ "[email protected]" ] } ] }, "scores": { "old": { "global": { "score": 0.9137943314711305, "percentile": 0.9798484036161283, "computed_at": "2025-03-16T07:27:24.000Z" }, "epss_v3": { "score": 0.90299, "percentile": 0.92938, "computed_at": "2025-03-16T15:46:16.000Z" }, "epss_v4": { "score": 0.8991291982186883, "percentile": 0.966181146025878, "computed_at": "2025-03-16T18:46:04.000Z" } }, "new": { "global": { "score": 0.9713943314711305, "percentile": 0.9998484036161284, "computed_at": "2025-03-16T07:27:24.000Z" }, "epss_v3": { "score": 0.92099, "percentile": 0.99238, "computed_at": "2025-03-16T15:46:16.000Z" }, "epss_v4": { "score": 0.9091291982186883, "percentile": 0.996181146025878, "computed_at": "2025-03-16T18:47:04.000Z" } } } }, "generated_at": "2025-04-02T21:20:15.366Z" } ]