CVE-2024-22393: Apache Answer: Pixel Flood Attack by uploading the large pixel file
First published: Thu Feb 22 2024(Updated: )
Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer through 1.2.1. Pixel Flood Attack by uploading large pixel files will cause server out of memory. A logged-in user can cause such an attack by uploading an image when posting content. Users are recommended to upgrade to version 1.2.5, which fixes the issue.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/apache/incubator-answer | <1.2.5 | 1.2.5 |
| Apache Answer | <1.2.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-22393?
CVE-2024-22393 is categorized as a critical vulnerability due to its potential for creating an out-of-memory condition on affected servers.
How do I fix CVE-2024-22393?
To fix CVE-2024-22393, update Apache Answer to version 1.2.5 or later.
What software versions are affected by CVE-2024-22393?
CVE-2024-22393 affects Apache Answer versions prior to 1.2.1.
What types of files can be exploited in CVE-2024-22393?
CVE-2024-22393 is exploited by uploading large pixel files, which can overwhelm server memory.
Who can exploit CVE-2024-22393?
Any logged-in user can exploit CVE-2024-22393 by uploading an image to the affected Apache Answer server.
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/type
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-22393
- agent/references
- agent/softwarecombine
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/severity
- collector/nvd-cve
- source/NVD
- agent/trending
- agent/source
- agent/tags
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-rmqp-mvv2-54c6
- agent/software-canonical-lookup
- agent/event
- agent/description
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- package-manager/go
- vendor/apache
- canonical/apache answer