CVE-2024-41888

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

M

issing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked. Users are recommended to upgrade to version 1.3.6, which fixes the issue.

References

Link	Resource
https://lists.apache.org/thread/jbs1j2o9rqm5sc19jyk3jcfvkmfkmyf4	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/08/09/5

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*

History

21 Nov 2024, 09:33

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2024/08/09/5 -

29 Aug 2024, 12:55

Type	Values Removed	Values Added
First Time		Apache Apache answer
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3
CPE		cpe:2.3:a:apache:answer::::::::
References	~~() https://lists.apache.org/thread/jbs1j2o9rqm5sc19jyk3jcfvkmfkmyf4 -~~	() https://lists.apache.org/thread/jbs1j2o9rqm5sc19jyk3jcfvkmfkmyf4 - Mailing List, Vendor Advisory

12 Aug 2024, 13:41

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-12 13:38

Updated : 2025-03-13 20:15

NVD link : CVE-2024-41888

Mitre link : CVE-2024-41888

CVE.ORG link : CVE-2024-41888

JSON object : View

Products Affected

answer

CWE

CWE-772

Missing Release of Resource after Effective Lifetime

{"id": "CVE-2024-41888", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-08-12T13:38:31.617", "references": [{"url": "https://lists.apache.org/thread/jbs1j2o9rqm5sc19jyk3jcfvkmfkmyf4", "tags": ["Mailing List", "Vendor Advisory"], "source": "[email protected]"}, {"url": "http://www.openwall.com/lists/oss-security/2024/08/09/5", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-772"}]}], "descriptions": [{"lang": "en", "value": "Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.3.5.\n\nThe password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked.\nUsers are recommended to upgrade to version 1.3.6, which fixes the issue."}, {"lang": "es", "value": "Falta la versi\u00f3n de recurso despu\u00e9s de la vulnerabilidad de duraci\u00f3n efectiva en Apache Answer. Este problema afecta a Apache Answer: hasta 1.3.5. El enlace para restablecer la contrase\u00f1a sigue siendo v\u00e1lido dentro de su per\u00edodo de vencimiento, incluso despu\u00e9s de haber sido utilizado. Esto podr\u00eda provocar un uso indebido o un secuestro del enlace. Se recomienda a los usuarios actualizar a la versi\u00f3n 1.3.6, que soluciona el problema."}], "lastModified": "2025-03-13T20:15:22.213", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43EA3C87-1BF0-4544-9DAA-A0B3D8D4EA1B", "versionEndExcluding": "1.3.6"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}