PT-2024-19386 · Apache · Apache Answer

Mohammad Reza Omrani · Published 2024-02-22 · Updated 2025-05-05 · CVE-2024-22393

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Answer versions through 1.2.1

Description The issue affects Apache Answer, allowing a logged-in user to cause a Pixel Flood Attack by uploading large pixel files, which can cause the server to run out of memory. This can be done by uploading an image when posting content.

Recommendations For Apache Answer versions through 1.2.1, upgrade to version 1.2.5, which fixes the issue. As a temporary workaround, consider restricting image uploads for logged-in users until the patch is applied.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-22393

GHSA-RMQP-MVV2-54C6

GO-2024-2579

Affected Products

Apache Answer

References · 15

• https://osv.dev/vulnerability/GO-2024-2579 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22393 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22393 · Security Note
• https://lists.apache.org/thread/f58l6dr4r74hl6o71gn47kmn44vw12cv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rmqp-mvv2-54c6 · Vendor Advisory
• https://github.com/apache/incubator-answer · Note
• https://twitter.com/oss_security/status/1760716665187110994 · Twitter Post
• https://t.me/cvenotify/120889 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1760853995403514259 · Twitter Post
• https://twitter.com/CVEnew/status/1760609281533993298 · Twitter Post
• https://github.com/advisories/GHSA-rmqp-mvv2-54c6 · Note
• http://openwall.com/lists/oss-security/2024/02/22/1 · Note
• https://twitter.com/omranisecurity/status/1760613443122393182 · Twitter Post
• https://t.me/cvenotify/72198 · Telegram Post
• https://t.me/cvenotify/72220 · Telegram Post