weak Password Policy Directory Protection in froxlor/froxlor
Reported on
Jan 28th 2023
Hello,
The strong Password Policy is everywhere in place.
BUT
The Directory Protection Part allows to bypass this strong Password Policy and setting a Password like
- This is very easy to bruteforce.
Lets see :)
Password is set to 1 and it will get accepted.
As you can see the Password got accepted.
Lets try it on another Place where the strong Password Policy is in Place
FTP is setting a strong password policy and not allowing the password 1
Thank you for watching :)
Best regards Ahmed Hassan
Impact
Hello,
The strong Password Policy is everywhere in place.
BUT
The Directory Protection Part allows to bypass this strong Password Policy and setting a Password like
- This is very easy to bruteforce.
Lets see :)
Password is set to 1 and it will get accepted.
As you can see the Password got accepted.
Lets try it on another Place where the strong Password Policy is in Place
FTP is setting a strong password policy and not allowing the password 1
Thank you for watching :)
Best regards Ahmed Hassan
References
Hello
Why can i not see the CVE on NIST it tells me the CVE has not been found.
https://nvd.nist.gov/vuln/detail/CVE-2023-0564
Hello,
I just have a question please can you assign the CVE to 2 Persons or more ?
Cause we worked on many Vulnerabilities together.
Would this be possible ?
Thank you