PT-2024-29619 · Apache · Apache Answer

Mohammad Reza Omrani · Published 2024-08-09 · Updated 2024-08-29 · CVE-2024-41888

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Answer versions through 1.3.5

Description The password reset link remains valid within its expiration period even after it has been used, potentially leading to misuse or hijacking.

Recommendations For Apache Answer versions through 1.3.5, upgrade to version 1.3.6 to fix the issue.

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2024-41888

GHSA-V3X9-WRQ5-868J

GO-2024-3065

Affected Products

Apache Answer

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-41888 · Security Note
• https://osv.dev/vulnerability/GO-2024-3065 · Vendor Advisory
• https://lists.apache.org/thread/jbs1j2o9rqm5sc19jyk3jcfvkmfkmyf4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41888 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v3x9-wrq5-868j · Vendor Advisory
• https://github.com/apache/incubator-answer/commit/2820efc454f5808974dce0aa99aac106be3f727b · Note
• http://openwall.com/lists/oss-security/2024/08/09/5 · Note
• https://t.me/cvenotify/92646 · Telegram Post
• https://github.com/advisories/GHSA-v3x9-wrq5-868j · Note