PT-2024-29619 · Apache · Apache Answer

Mohammad Reza Omrani · CVE-2024-41888 · Published 2024-08-09 · Updated 2024-08-29

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Answer versions through 1.3.5

Description The password reset link remains valid within its expiration period even after it has been used, potentially leading to misuse or hijacking.

Recommendations For Apache Answer versions through 1.3.5, upgrade to version 1.3.6 to fix the issue.

Exploit

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2024-41888

GHSA-V3X9-WRQ5-868J

GO-2024-3065

Affected Products

Apache Answer

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41888.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-41888 · Vendor Advisory
• https://lists.apache.org/thread/jbs1j2o9rqm5sc19jyk3jcfvkmfkmyf4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41888 · Security Note
• https://osv.dev/vulnerability/GHSA-v3x9-wrq5-868j · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3065 · Vendor Advisory
• https://github.com/apache/incubator-answer/commit/2820efc454f5808974dce0aa99aac106be3f727b · Note
• https://t.me/cvenotify/92646 · Telegram Post
• http://openwall.com/lists/oss-security/2024/08/09/5 · Note
• https://github.com/advisories/GHSA-v3x9-wrq5-868j · Note