ownCloud · Report #276123
Password Complexity Not Enforced On Password Change
Validstatus
lowseverity
9upvotes
3 Mar 2018disclosed
How it was found
Hi!
Owncloud does not enforce password complexity on password change, so it's possible to use passwords of any size or form.
In example I can set my password to be "a" or "qwerty".
How to reproduce: Change your password to something that does not match your required complexity.
Proof Of Concept: Login with my dummy account account --> "[email protected]" password --> "q"
Thanks! WdeM