HexBrain

Nextcloud · Report #188132

Wordpress Version Disclosure Bug On Nextcloud

Informativestatus
lowseverity
6upvotes
4 Dec 2016disclosed

How it was found

Hi @nextcloud ,

#Description Wordpress version disclosure.

#Affected items https://nextcloud.com/readme.html https://nextcloud.com/wp-admin/install.php https://nextcloud.com/wp-login.php

#The impact of this vulnerability Possible Wordpress Version information disclosure.You are using wordpress 4.6.1 version also you not delete https://nextcloud.com/wp-admin/install.php if you got any type of database problem in your site attacker try to install it for deface,And to be noted that you not protect your admin panel https://nextcloud.com/wp-login.php with captcha attacker can easily Bruteforce your admin panel.

#Web references

#How to fix this vulnerability

  1. Just Delete The readme.html from / root path
  2. and also delete install.php from /wp-admin/

Please resolved as close if not acceptable.Because this is my first hunting ;) . Thanks

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original