I am checking a web application with OWASP Zed Attack Proxy (ZAP).
There is a vulnerability (low) that says "private IP address disclosure" and when I check for more details I found that it is my IP, and there is a function that just reflects the "logged-in" user IP address so that a user can log in and with a specific request and response can see the IP address of his own and not other users.
What is the risk of this? And why did ZAP tag it as a low vulnerability?
This is more of an issue when the private IP address belongs to the server, since it can give an indication of how the infrastructure of the website is configured. For example, if you find some method of scanning from the server, knowing the IP range it's on saves a lot of time when looking for other systems - only having to scan 192.168.1.1-255 is a lot quicker than having to scan all private ranges.
If you get multiple values during browsing, it could indicated a load balanced solution, or that different parts of the application are hosted on different servers. All useful things to know, even if they don't directly get additional access.
Most scanners don't attempt to distinguish between your own private IP address and a remote system one, since they could well be the same - there are a limited number of private ranges, after all.
It's just a form of information disclosure, like the server name in an HTTP header, or an internal path to the application files. It probably won't cause issues on it's own, but can make exploitation of other issues easier.
