Nextcloud logs ldap passwords
Low
N
Nextcloud
Submitted None
Actions:
Reported by
tribut
Vulnerability Details
Technical details and impact analysis
When the ldap server is (temporarily) unavailable, data like the attached ends up in log files. I've replaced usernames with `XXX_USERn_XXX` and passwords with `XXX_PASSn_XXX`. It seems that at least the following are missing from `$methodsWithSensitiveParameters` in `lib/private/Log.php`:
- `bind`
- `areCredentialsValid`
- `invokeLDAPMethod`
- `checkPasswordNoLogging`
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Plaintext Storage of a Password