Lucene search

K
hackeroneSpell1H1:2245437
HistoryNov 09, 2023 - 8:35 a.m.

Nextcloud: App PIN code can be bypassed in Files iOS

2023-11-0908:35:49
spell1
hackerone.com
14
nextcloud
ios
pin bypass
vulnerability
authentication bypass
bug bounty

6.8 Medium

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.1%

Hi Team,

Hope you are doing great.

Note: IoS APP Vs.: 4.9.1

I got a vulnerability in your applications via which an attacker is able to bypass the PIN.
The attacker just need to bruteforce the 4 digit PIN as unlimited tries is accepted by the application, the attacker can simply do a bruteforce and access the application.

PoC:
{F2844276}

Impact

Authentication Bypass leading to application access

6.8 Medium

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.1%