HexBrain

Nextcloud · Report #146424

No Rate Limiting on stats.nextcloud.com login

Informativestatus
12upvotes
22 Jun 2016disclosed

How it was found

There is no defenses or any lockout mechanism on stats.nextcloud.com login , a malicious minded user can continue guessing an account password limitless, and this might cause to completely compromised the site.

Recommendation: Put a rate limit or a any lockout mechanism

Regards Japz

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original