Nextcloud · Report #165353
**minor issue ** -Nextcloud 10.0 session issue with desktop client and android client
Validstatus
mediumseverity
3upvotes
1 Mar 2020disclosed
How it was found
Scenario:
--> Installed nextcloud 10.0 locally and created "admin" account --> Installed nextcloud desktop client and andoid client
I found session related vulnerability in nextcloud 10.0 where killing session in User(admin) --> Personal --> Sessions not actually killing sessions in desktop client
Steps:
- Logged into admin account in browser
- Logged into admin account in desktop client and android client. Currently admin account is having 3 sessions : browser, desktop, andoid
- Goto User(admin) --> Personal --> Sessions --> kill desktop client session --> upload new file using browser --> Still dekstop client is syncing files without asking any password prompt (issue1)
- Though android client is still active, sessions are not capturing in personal --> sessions tab
Hope these are minor issues