Описание
Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)
Impact
It was possible to retrieve user notification settings or list all users via API.
Patches
References
Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to Weblate.
Пакеты
Наименование
Weblate
pip
Затронутые версииВерсия исправления
< 5.15
5.15
Связанные уязвимости
CVSS3: 4.3
nvd
около 2 месяцев назад
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.
CVSS3: 4.3
debian
около 2 месяцев назад
Weblate is a web based localization tool. In versions prior to 5.15, i ...