Loading HuntDB...

Information Disclosure on demo.weblate.org

Low
W
Weblate
Submitted None
Reported by sp1d3rs

Vulnerability Details

Technical details and impact analysis

Information Disclosure
##Description The demo instance, located on https://demo.weblate.org is leaking user's IP-adresses in the Activity log. {F185728} ##Impact The authenticated user can disclose valid IP adresses of other users through Activity log. The feature works as it should (*so no changes should be made on the GitHub or other sites like hosted.weblate.org*), but i still recommend you to hide IPs that do not belong to the user only on this particular instance, because user do not know before login, that his IP will become accessible to the public. ##Reproduction Steps 1) Login at the https://demo.weblate.org as demo:demo 2) Go to the https://demo.weblate.org/accounts/profile/#audit ##Suggested fix The sensitive information can be hided in various ways - for example `x.x.x.x` or similar. It do not require code changes on your GitHub repositories, just in this particular instance.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Information Disclosure