| タイトル | makeplane plane <=1.4.2 Use of Less Trusted Source |
|---|
| 説明 | Plane exposes multiple unauthenticated API endpoints that return distinguishable responses depending on whether a supplied email address belongs to a registered user. An AuthenticationThrottle (DRF AnonRateThrottle) rate-limits these endpoints, but the throttle key is derived from the X-Forwarded-For header without requiring a trusted proxy configuration (NUM_PROXIES is unset). An unauthenticated attacker can rotate the X-Forwarded-For value to bypass the rate limit and enumerate registered email addresses at arbitrary speed. |
|---|
| ソース | ⚠️ https://github.com/makeplane/plane/issues/9913 |
|---|
| ユーザー | ZAST.AI (UID 87884) |
|---|
| 送信 | 2026年09月29日 11:22 (18 日 ago) |
|---|
| モデレーション | 2026年10月17日 11:31 (18 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 421581 [makeplane 迄 1.4.2 API Endpoint X-Forwarded-For 情報漏えい] |
|---|
| ポイント | 20 |
|---|