Whistlelink: Site-access password exposed in web server access logs via GET query string

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-07-02 18:40 UTC
Importiert: 2026-07-21 05:51 UTC
Quelle-ID: full_disc
uid_hash: b4b5338f688c3797fa830561643e52b5370f380a6cccd189fbc693a7817e031a

Full Disclosure

Posted by Red Nanaki via Fulldisclosure on Jul 02 Whistlelink: Site-access password exposed in web server access logs via GET

query string

Severity: CRITICAL

SUMMARY

The Whistlelink reporting portal protects optionally-enabled, password-gated

whistleblowing sites with a site-access password. When a visitor unlocks such a

site, the client validates the password by issuing an HTTP GET request that

carries the password as a URL query-string parameter:

GET...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss