Nextcloud · Report #146424
No Rate Limiting on stats.nextcloud.com login
Informativestatus
12upvotes
22 Jun 2016disclosed
How it was found
There is no defenses or any lockout mechanism on stats.nextcloud.com login , a malicious minded user can continue guessing an account password limitless, and this might cause to completely compromised the site.
Recommendation: Put a rate limit or a any lockout mechanism
Regards Japz