PT-2024-13768 · Apache · Apache Answer

Ek1Ng · Published 2024-01-10 · Updated 2025-06-11 · CVE-2023-49619

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Answer versions through 1.2.0

Description The issue is related to a 'Race Condition' vulnerability due to improper synchronization when using shared resources. Normally, a user can only bookmark a question once, increasing the bookmark count by one. However, through repeated submissions using scripts, the number of question collections can be increased multiple times.

Recommendations For versions through 1.2.0, upgrade to version 1.2.1, which fixes the issue. As a temporary workaround, consider restricting the ability to submit bookmarks repeatedly to minimize the risk of exploitation.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2023-49619

GHSA-F899-4MR4-FQPV

GO-2024-2457

Affected Products

Apache Answer

References · 16

• https://lists.apache.org/thread/nscrl3c7pn68q4j73y3ottql6n5x3hd4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49619 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49619 · Security Note
• https://osv.dev/vulnerability/GO-2024-2457 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f899-4mr4-fqpv · Vendor Advisory
• https://github.com/apache/incubator-answer · Note
• https://github.com/advisories/GHSA-f899-4mr4-fqpv · Note
• http://openwall.com/lists/oss-security/2024/01/10/1 · Note
• https://twitter.com/VulmonFeeds/status/1745048063352218031 · Twitter Post
• https://t.me/cvenotify/66916 · Telegram Post
• https://t.me/cvenotify/125405 · Telegram Post
• https://t.me/cvenotify/67689 · Telegram Post
• https://twitter.com/RedPacketSec/status/1745386462776791487 · Twitter Post
• https://twitter.com/oss_security/status/1745076651958919673 · Twitter Post
• https://t.me/cvenotify/66884 · Telegram Post