VT 1.3.6.1.4.1.25623.1.0.103564 misidentifies OpenCloud as ownCloud, causing false positives

Scanning / scan configuration
1

GVM versions

gsad: Greenbone Security Assistant 24.16.0~git
gvmd: Greenbone Vulnerability Manager 26.24.0 (Manager DB revision 273)
openvas-scanner: OpenVAS 23.45.1
gvm-libs: gvm-libs 22.41.0

Environment

Operating system: Kali Linux (rolling)
Kernel: Linux 7.1.5+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.1.5-1kali1 (2026-07-29) x86_64
Installation method / source: distribution packages (Kali)
Feed version (NVT): 202608270833

Summary

VT 1.3.6.1.4.1.25623.1.0.103564 (ownCloud / ownCloud Infinite Scale Detection (HTTP)) identifies OpenCloud installations as ownCloud and registers cpe:/a:owncloud:owncloud:0.1.0. Because 0.1.0 is below the fixed version of every ownCloud advisory, 22 downstream version-based VTs then report the host as vulnerable, several at High severity.

This is a single defect in the detection VT. The version-check VTs behave correctly given the CPE they receive.

Root cause

The detection VT’s own result states what it concluded from:

Detected ownCloud

Version:       0.1.0
Location:      /
CPE:           cpe:/a:owncloud:owncloud:0.1.0

Concluded from version/product identification result:
version": "0.1.0.0",

It evaluates the version field of status.php and does not consider productname.

OpenCloud (https://opencloud.eu) is an actively maintained fork of ownCloud Infinite Scale. It implements ownCloud’s status.php contract so that existing ownCloud clients keep working, and therefore sets the ownCloud-compatibility fields version and versionstring to a static placeholder. Its real version is exposed separately:

$ curl -sk https://<host>:9200/status.php
{
    "installed": true,
    "maintenance": false,
    "needsDbUpgrade": false,
    "version": "0.1.0.0",
    "versionstring": "0.1.0",
    "edition": "rolling",
    "productname": "OpenCloud",
    "product": "OpenCloud",
    "productversion": "7.4.0",
    "channel": ""
}

Since version is static across all OpenCloud releases, every OpenCloud instance will be reported as vulnerable to every ownCloud advisory regardless of its actual version or patch level. The host in question runs OpenCloud 7.4.0.

Downstream VTs firing as a result (22, all QoD 80)

1.3.6.1.4.1.25623.1.0.148256  ownCloud < 10.10.0 Information Disclosure Vulnerability
1.3.6.1.4.1.25623.1.0.127812  ownCloud < 10.13.0 CSRF Vulnerability
1.3.6.1.4.1.25623.1.0.127730  ownCloud < 10.13.3 Improper Input Validation Vulnerability
1.3.6.1.4.1.25623.1.0.127729  ownCloud < 10.14.0 Multiple Improper Input Validation Vulnerabilities
1.3.6.1.4.1.25623.1.0.125578  ownCloud < 10.15.1 Information Disclosure Vulnerability
1.3.6.1.4.1.25623.1.0.125577  ownCloud < 10.15.2 Phar Stream Wrapper Vulnerability
1.3.6.1.4.1.25623.1.0.125576  ownCloud < 10.15.3 Multiple Vulnerabilities
1.3.6.1.4.1.25623.1.0.144857  ownCloud < 10.2.1 Share Permission Vulnerability
1.3.6.1.4.1.25623.1.0.144858  ownCloud < 10.3.0 Group Share Deletion Vulnerability
1.3.6.1.4.1.25623.1.0.144860  ownCloud < 10.3.2 SSRF Vulnerability
1.3.6.1.4.1.25623.1.0.144861  ownCloud < 10.4 Access Control Vulnerability
1.3.6.1.4.1.25623.1.0.145104  ownCloud < 10.5 XSS Vulnerability
1.3.6.1.4.1.25623.1.0.145995  ownCloud < 10.7 Information Disclosure Vulnerability
1.3.6.1.4.1.25623.1.0.804276  ownCloud Multiple XSS & CSRF Vulnerabilities -01 (May 2014)
1.3.6.1.4.1.25623.1.0.804278  ownCloud Cross Site Request Forgery Vulnerability -01 (May 2014)
1.3.6.1.4.1.25623.1.0.804280  ownCloud Multiple Code Execution & Local File Disclosure Vulnerabilities (May 2014)
1.3.6.1.4.1.25623.1.0.804281  ownCloud 'contacts' Security Bypass Vulnerability (May 2014)
1.3.6.1.4.1.25623.1.0.804282  ownCloud Flash Cross-Domain Information Disclosure Vulnerability
1.3.6.1.4.1.25623.1.0.804283  ownCloud Multiple Cross Site Scripting Vulnerabilities -02 (May 2014)
1.3.6.1.4.1.25623.1.0.804284  ownCloud Multiple Cross Site Scripting Vulnerabilities -03 (May 2014)
1.3.6.1.4.1.25623.1.0.804362  ownCloud Multiple XSS Vulnerabilities-02 (Apr 2014)
1.3.6.1.4.1.25623.1.0.804412  ownCloud Multiple XSS and SQL Injection Vulnerabilities

Each reports Installed version: 0.1.0 against its respective fixed version. Highest severities observed: 8.5, 8.3, 8.0, 7.5.

Happy to supply further scanner output or re-test against an updated VT.

2

This looks completely broken and IMHO needs a bug report for the vendor. I don’t see anything to do here from VT side.

3

As a short follow-up, the vendor seems to be already aware since quite some time that wrong info is getting published:

and even seems to consider to remove this completely:

1 Like