Information Disclosure on demo.weblate.org
Low
W
Weblate
Submitted None
Actions:
Reported by
sp1d3rs
Vulnerability Details
Technical details and impact analysis
##Description
The demo instance, located on https://demo.weblate.org is leaking user's IP-adresses in the Activity log.
{F185728}
##Impact
The authenticated user can disclose valid IP adresses of other users through Activity log. The feature works as it should (*so no changes should be made on the GitHub or other sites like hosted.weblate.org*), but i still recommend you to hide IPs that do not belong to the user only on this particular instance, because user do not know before login, that his IP will become accessible to the public.
##Reproduction Steps
1) Login at the https://demo.weblate.org as demo:demo
2) Go to the https://demo.weblate.org/accounts/profile/#audit
##Suggested fix
The sensitive information can be hided in various ways - for example `x.x.x.x` or similar. It do not require code changes on your GitHub repositories, just in this particular instance.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Information Disclosure