CVE-2024-26578: Apache Answer: Repeated submission at registration created duplicate users with the same name
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer. This issue affects Apache Answer through 1.2.1.
Repeated submission during registration resulted in the registration of the same user. When users register, if they rapidly submit multiple registrations using scripts, it can result in the creation of multiple user accounts simultaneously with the same name.
Users are recommended to upgrade to version 1.2.5, which fixes the issue.
Other sources
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1.
Repeated submission during registration resulted in the registration of the same user. When users register, if they rapidly submit multiple registrations using scripts, it can result in the creation of multiple user accounts simultaneously with the same name. Users are recommended to upgrade to version [1.2.5], which fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/apache/incubator-answerto a version that resolves this vulnerability.Fixed in 1.2.5 - Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 1.2.5 - Compensating control
During registration, avoid rapidly submitting multiple registrations in parallel (e.g., via scripts), as it can cause multiple user accounts with the same name due to a race condition.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26578?
CVE-2024-26578 is classified as a critical vulnerability due to its potential impact on user registrations.
How do I fix CVE-2024-26578?
To mitigate CVE-2024-26578, upgrade Apache Answer to version 1.2.5 or higher.
What are the consequences of CVE-2024-26578?
The consequences of CVE-2024-26578 include the potential for duplicate user registrations, leading to data integrity issues.
Which versions of Apache Answer are affected by CVE-2024-26578?
CVE-2024-26578 affects Apache Answer versions up to and including 1.2.1.
Who can be impacted by CVE-2024-26578?
Users and administrators of Apache Answer are at risk of being impacted by CVE-2024-26578 due to improper synchronization during user registration.