地图 / Password policy changes not enforced for existing passwords

Password policy changes not enforced for existing passwords

密码学缺陷 / Weak Cryptography for Passwords / #1169335

厂商: Nextcloud
严重程度: 低危
赏金: —
弱点: Weak Cryptography for Passwords
研究员: @rtod
披露日期: 2021-04-26
资产: nextcloud/password_policy
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（1515 字符中的一小部分）

So this is two reports in one. Sort of. But they are the same issue, or at least related.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Nextcloud 所有。

时间线

2021-04-20报告提交
2021-04-26公开披露

阅读 HackerOne 原文 ↗作者 @rtod · 版权归作者与 Nextcloud 所有

同类报告

Default password on 34.120.209.175Elastic · 2022-11-18 Generated passwords are not fully validated by HIBPValidatorNextcloud · 2022-10-01 · $100 User Account has been taken outReddit · 2021-10-21 No password length restrictionUdemy · 2017-08-28 Password complexity ignores empty spacesLegal Robot · 2017-08-26 Setting a password with a single characterWeblate · 2017-05-18