• Welcome to the Chevereto User Community!

    Here, users from all over the world come together to learn, share, and collaborate on everything related to Chevereto. It's a place to exchange ideas, ask questions, and help improve the software.

    Please keep in mind:

    • This community is user-driven. Always be polite and respectful to others.
    • Support development by purchasing a Chevereto license, which also gives you priority support.
    • Go further by joining the Community Subscription for even faster response times and to help sustain this space

Must read [GHSA-h4jp-mxfx-g8xp] Private profile setting leaking username on /json endpoint

Rodolfo

Rodolfo

👑 Chevereto Godlike
Chevereto Staff
Administrator
As per our self-discovered vulnerability disclosure, we have just published the security advisory for [Security] Fix private profile setting leaking username on /json endpoint

Affected software
  • Chevereto >= 3.7.5, < 4.5.4 (patched)
  • rodber/chevereto-free >= 1.0.0
This issue is fixed on Chevereto >= 4.5.4

LINK
github.com

Private profile setting leaking username on /json endpoint

### Impact When a user enables the private profile option, visiting their profile HTML route (`/username`) correctly returns 404. However, the `/json` AJAX listing endpoint does not apply the same...
github.com github.com
 
You must log in or register to reply here.
Back
Top