PT-2024-29621 · Apache · Apache Answer

Mohammad Reza Omrani · Published 2024-08-09 · Updated 2024-08-29 · CVE-2024-41890

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Answer versions through 1.3.5

Description The issue affects Apache Answer, where a user can send multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked.

Recommendations For versions through 1.3.5, upgrade to version 1.3.6 to fix the issue.

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2024-41890

GHSA-GVPV-R32V-9737

GO-2024-3064

Affected Products

Apache Answer

References · 9

• https://lists.apache.org/thread/j7c080xj31x8rvz1pyk2h47rdd9pwbv9 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3064 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41890 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41890 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gvpv-r32v-9737 · Vendor Advisory
• https://github.com/apache/incubator-answer/commit/2820efc454f5808974dce0aa99aac106be3f727b · Note
• https://t.me/cvenotify/92647 · Telegram Post
• http://openwall.com/lists/oss-security/2024/08/09/4 · Note
• https://github.com/advisories/GHSA-gvpv-r32v-9737 · Note