CVE-2024-41890

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

M

issing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked. Users are recommended to upgrade to version 1.3.6, which fixes the issue.

References

Link	Resource
https://lists.apache.org/thread/j7c080xj31x8rvz1pyk2h47rdd9pwbv9	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/08/09/4

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*

History

21 Nov 2024, 09:33

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2024/08/09/4 -

29 Aug 2024, 12:56

Type	Values Removed	Values Added
First Time		Apache Apache answer
References	~~() https://lists.apache.org/thread/j7c080xj31x8rvz1pyk2h47rdd9pwbv9 -~~	() https://lists.apache.org/thread/j7c080xj31x8rvz1pyk2h47rdd9pwbv9 - Mailing List, Vendor Advisory
CPE		cpe:2.3:a:apache:answer::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3

12 Aug 2024, 13:41

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-12 13:38

Updated : 2025-03-13 19:15

NVD link : CVE-2024-41890

Mitre link : CVE-2024-41890

CVE.ORG link : CVE-2024-41890

JSON object : View

Products Affected

answer

CWE

CWE-772

Missing Release of Resource after Effective Lifetime

{"id": "CVE-2024-41890", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-08-12T13:38:31.733", "references": [{"url": "https://lists.apache.org/thread/j7c080xj31x8rvz1pyk2h47rdd9pwbv9", "tags": ["Mailing List", "Vendor Advisory"], "source": "[email protected]"}, {"url": "http://www.openwall.com/lists/oss-security/2024/08/09/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-772"}]}], "descriptions": [{"lang": "en", "value": "Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.3.5.\n\nUser sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked.\nUsers are recommended to upgrade to version 1.3.6, which fixes the issue."}, {"lang": "es", "value": "Falta la versi\u00f3n de recurso despu\u00e9s de la vulnerabilidad de duraci\u00f3n efectiva en Apache Answer. Este problema afecta a Apache Answer: hasta 1.3.5. El usuario env\u00eda varios correos electr\u00f3nicos para restablecer la contrase\u00f1a, cada uno de los cuales contiene un enlace v\u00e1lido. Dentro del per\u00edodo de validez del enlace, esto podr\u00eda dar lugar a un uso indebido o un secuestro del mismo. Se recomienda a los usuarios actualizar a la versi\u00f3n 1.3.6, que soluciona el problema."}], "lastModified": "2025-03-13T19:15:47.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43EA3C87-1BF0-4544-9DAA-A0B3D8D4EA1B", "versionEndExcluding": "1.3.6"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}