地图 / Brute force protections don't work

Brute force protections don't work

信息泄露 / 隐私侵犯 / #1596918

厂商: Nextcloud
严重程度: 低危 · CVSS 3.7
赏金: —
弱点: 隐私侵犯
研究员: @nickvergessen
披露日期: 2022-09-03
资产: nextcloud/server
CVE: CVE-2022-31118

该报告还没有中文解读。

原文摘录

摘自原文（503 字符中的一小部分）

Summary: Most of the brute force protections don't actually throttle() the response and so they are not logging negative attempts

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Nextcloud 所有。

时间线

2022-06-10报告提交
2022-09-03公开披露

阅读 HackerOne 原文 ↗作者 @nickvergessen · 版权归作者与 Nextcloud 所有

同类报告

Physical Laptop TakeoverEd · 2018-08-12 Connection informaton is sent to a third-party serviceNord Security · —Blocked user can see live videoTikTok · 2021-05-28 · $418 Twitter ID exposure via error-based side-channel attackX / xAI · 2019-05-16 · $1,470 Intent Leads To Unauthorised Video Call Initiation Leaking Surrounding Informations Of VictimSnapchat · 2024-04-05 Changing email address on Twitter for Android unsets "Protect your Tweets"X / xAI · 2019-01-18 · $2,940

Brute force protections don't work · 破甲 POJIA