Listen to this Post
How the mentioned CVE works:
Weblate is a web-based localization tool. In versions 5.14 and below, a vulnerability exists where the IP address of project members inviting users is leaked. When an administrator or project member invites a user, the system logs this action in the audit log. The audit log captures the inviter’s IP address from HTTP requests during the invitation event. This log is intended for administrative tracking but is accessible to invited users. Invited users can view the audit log after accepting invitations, exposing the inviter’s IP address. The IP address is sensitive data that can reveal network details and location. The vulnerability stems from inadequate filtering of IP addresses in audit logs for admin-triggered actions visible to users. The logging mechanism does not restrict access to these entries, leading to information disclosure. This issue is fixed in version 5.14.1 by modifying the audit log to exclude IP addresses from such actions or by tightening view permissions. The patch prevents unauthorized access to IP addresses, ensuring privacy. It addresses improper access control and sensitive data exposure. Attackers could exploit this by being invited to gather admin IPs for profiling or targeted attacks. Upgrading to the patched version is essential to mitigate the risk.
Platform: Weblate
Version: 5.14 below
Vulnerability: IP address leak
Severity: Medium
Date: 2025-11-06
Prediction: Patch 2025-11-06
What Undercode Say:
Analytics:
Check Weblate version
curl -s http://localhost/api/version | grep "5.14"
View audit log entries
grep "invitation" /var/log/weblate/audit.log
Extract IP addresses from logs
cat /var/log/weblate/audit.log | awk '{print $NF}'
Test access as invited user
curl -H "Authorization: Token <user_token>" http://localhost/api/audit-log/
How Exploit:
Invite attacker user. Attacker views audit log. Retrieves admin IP address.
Protection from this CVE:
Upgrade to 5.14.1. Restrict audit log access. Filter IP logging.
Impact:
Privacy violation. Information disclosure. Potential targeted attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
