Release: Merge release into master from: release/2.49.1

[github-actions]

Release triggered by rossops

[dryrunsecurity]

This pull request contains a potential information disclosure vulnerability in the user.tpl webhook template, which exposes sensitive personally identifiable information (PII) such as user ID, email, username, and name without apparent configuration options to limit the data transmission.

Information Disclosure in Webhook Template in dojo/templates/notifications/webhooks/subtemplates/user.tpl

Vulnerability

Information Disclosure in Webhook Template

Description

The user.tpl template, which is included in various webhook payloads, explicitly exposes sensitive user Personally Identifiable Information (PII) including id, email, username, first_name, and last_name. This means that all webhooks utilizing this template will transmit this PII, creating a risk of information disclosure if the webhook endpoints are not properly secured or if the data is sent to untrusted parties. There are no apparent configuration options to control which PII fields are included in the webhook payload.

django-DefectDojo/dojo/templates/notifications/webhooks/subtemplates/user.tpl

Lines 1 to 16 in 4c4b9c2

	{% load display_tags %}
	{% load as_json %}
	{% if user %}
	{% url 'view_user' user.id as user_url_ui %}
	{% url 'user-detail' user.id as user_url_api %}
	user:
	id: {{ user.pk }}
	email: {{ user.email | as_json_no_html_esc }}
	username: {{ user.username | as_json_no_html_esc }}
	first_name: {{ user.first_name | as_json_no_html_esc }}
	last_name: {{ user.last_name | as_json_no_html_esc }}
	url_ui: {{ user_url_ui | full_url | as_json_no_html_esc }}
	url_api: {{ user_url_api | full_url | as_json_no_html_esc }}
	{% else %}
	user: {{ user | as_json_no_html_esc }}
	{% endif %}

---

All finding details can be found in the DryRun Security Dashboard.