HexBrain

ownCloud · Report #276123

Password Complexity Not Enforced On Password Change

Validstatus
lowseverity
9upvotes
3 Mar 2018disclosed

How it was found

Hi!

Owncloud does not enforce password complexity on password change, so it's possible to use passwords of any size or form.

In example I can set my password to be "a" or "qwerty".


How to reproduce: Change your password to something that does not match your required complexity.



Proof Of Concept: Login with my dummy account account --> "[email protected]" password --> "q"


Thanks! WdeM

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original