[\/vc_column_text][vc_column_text]<\/p>\r\n

[\/vc_column_text][vc_column_text]<\/p>\r\n

At the moment we consider version disclosure an accepted risk as an attacker can enumerate service versions using other means as well. (e.g. comparing behaviour)<\/p>\r\n

[\/vc_column_text][\/vc_column][vc_column width=”1\/2″][vc_icon icon_fontawesome=”fab fa-android” color=”custom” size=”lg” custom_color=”#0082c9″ css=”.vc_custom_1662530789329{margin-bottom: 15px !important;}”][vc_column_text]<\/p>\r\n

Attacks involving other Android apps on the device<\/h4>\r\n

[\/vc_column_text][vc_column_text]<\/p>\r\n

We do consider attacks involving other Android apps on the device as low or medium risk. Stored files can be hidden from other apps if appropriate storage option is selected inside the app. This should be secure, however, if the phone is compromised we don\u2019t guarantee data safety.<\/p>\r\n

[\/vc_column_text][\/vc_column][\/vc_row][vc_row css=”.vc_custom_1662477103473{margin-top: 2rem !important;margin-bottom: 2rem !important;}”][vc_column width=”1\/2″][vc_icon icon_fontawesome=”fas fa-check-circle” color=”custom” size=”lg” custom_color=”#0082c9″ css=”.vc_custom_1662530770082{margin-bottom: 15px !important;}”][vc_column_text]<\/p>\r\n

Content spoofing<\/h4>\r\n

[\/vc_column_text][vc_column_text]<\/p>\r\n

Generally speaking we consider content spoofing not a bounty-worthy vulnerability.<\/p>\r\n

[\/vc_column_text][\/vc_column][vc_column width=”1\/2″][vc_icon icon_fontawesome=”fas fa-check-circle” color=”custom” size=”lg” custom_color=”#0082c9″ css=”.vc_custom_1662530770082{margin-bottom: 15px !important;}”][vc_column_text]<\/p>\r\n

User enumeration<\/h4>\r\n

[\/vc_column_text][vc_column_text]<\/p>\r\n

We do not consider user enumeration a security risk as for convenience and for features such as Server-to-Server sharing this is an expected behaviour.<\/p>\r\n

[\/vc_column_text][\/vc_column][\/vc_row][vc_row css=”.vc_custom_1662477108563{margin-top: 2rem !important;margin-bottom: 2rem !important;}”][vc_column width=”1\/2″][vc_icon icon_fontawesome=”fas fa-sign-in-alt” color=”custom” size=”lg” custom_color=”#0082c9″ css=”.vc_custom_1662530822868{margin-bottom: 15px !important;}”][vc_column_text]<\/p>\r\n

Brute force of credentials<\/h4>\r\n

[\/vc_column_text][vc_column_text]<\/p>\r\n

Nextcloud 12 introduced brute force protection. If you find a way in which it is broken, it could qualify as a security issue. Of course we\u2019re aware that using TOR or similar solutions can be used to circumvent IP address based brute force protection. It is also not implemented in all endpoints, but should not allow guessing passwords at great speed from a single IP address.<\/p>\r\n

[\/vc_column_text][\/vc_column][vc_column width=”1\/2″][vc_icon icon_fontawesome=”fas fa-check-circle” color=”custom” size=”lg” custom_color=”#0082c9″ css=”.vc_custom_1662530770082{margin-bottom: 15px !important;}”][vc_column_text]<\/p>\r\n

Server-side request forgery<\/h4>\r\n

[\/vc_column_text][vc_column_text]<\/p>\r\n

Nextcloud ships with multiple features that perform sending requests to other hosts, we do consider this accepted behaviour and advocate people to deploy Nextcloud into its own seggregated network segment.<\/p>\r\n

[\/vc_column_text][\/vc_column][\/vc_row][\/vc_section]<\/p><\/div>","protected":false},"excerpt":{"rendered":"

[vc_row][vc_column][vc_column_text][\/vc_column_text][\/vc_column][\/vc_row][vc_section][vc_row equal_height=”yes” css=”.vc_custom_1662476609904{margin-bottom: 2rem !important;}”][vc_column][vc_column_text css=”.vc_custom_1665128736737{margin-bottom: 2rem !important;}”] Security overview\u00a0\u00a0|\u00a0\u00a0Security Advisories [\/vc_column_text][\/vc_column][vc_column width=”1\/2″][vc_icon icon_fontawesome=”fas fa-user-lock” color=”custom” size=”lg” custom_color=”#0082c9″ css=”.vc_custom_1662476966895{margin-bottom: 15px !important;}”][vc_column_text] Administrator privileges [\/vc_column_text][vc_column_text] We consider Nextcloud administrators ultimately trusted. It is for example expected behavior that a Nextcloud administrator can execute arbitrary code. [\/vc_column_text][\/vc_column][vc_column width=”1\/2″][vc_icon icon_fontawesome=”fas fa-cogs” color=”custom” size=”lg” custom_color=”#0082c9″ css=”.vc_custom_1662530600195{margin-bottom: 15px !important;}”][vc_column_text] Denial […]<\/p>\n","protected":false},"author":26,"featured_media":0,"parent":2255,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"inline_featured_image":false,"publish_to_discourse":"","publish_post_category":"","wpdc_auto_publish_overridden":"","wpdc_topic_tags":"","wpdc_pin_topic":"","wpdc_pin_until":"","discourse_post_id":"","discourse_permalink":"","wpdc_publishing_response":"","wpdc_publishing_error":"","footnotes":""},"class_list":["post-56441","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"\n