Nextcloud · Report #1018146
Potential DDoS when posting long data into workflow validation rules
Validstatus
mediumseverity
6upvotes
21 Jan 2021disclosed
Summary
A missing input validation in Nextcloud Server 20.0.1 allowed users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.