PT-2024-19828 · Apache · Apache Answer

Lyaa + 1 · Published 2024-02-22 · Updated 2025-03-28 · CVE-2024-23349

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Answer versions through 1.2.1

Description The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This occurs when a logged-in user modifies their own submitted question and inputs malicious code in the summary, creating an XSS attack.

Recommendations For Apache Answer versions through 1.2.1, upgrade to version 1.2.5, which fixes the issue. As a temporary workaround, consider restricting the input of malicious code in the summary field to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-23349

GHSA-8PF2-QJ4V-FJ64

GO-2024-2578

Affected Products

Apache Answer

References · 15

• https://osv.dev/vulnerability/CVE-2024-23349 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2578 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23349 · Security Note
• https://lists.apache.org/thread/y5902t09vfgy7892z3vzr1zq900sgyqg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8pf2-qj4v-fj64 · Vendor Advisory
• https://github.com/apache/incubator-answer · Note
• https://twitter.com/oss_security/status/1760716665187110994 · Twitter Post
• https://t.me/cvenotify/103861 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1760853995403514259 · Twitter Post
• http://openwall.com/lists/oss-security/2024/02/22/2 · Note
• https://twitter.com/CVEnew/status/1760603502978433454 · Twitter Post
• https://t.me/cvenotify/72221 · Telegram Post
• https://t.me/cvenotify/72199 · Telegram Post
• https://github.com/advisories/GHSA-8pf2-qj4v-fj64 · Note
• https://t.me/cvenotify/116875 · Telegram Post