CVE-2024-41890: Apache Answer: The link to reset the user's password will remain valid after sending a new link
First published: Fri Aug 09 2024(Updated: )
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked. Users are recommended to upgrade to version 1.3.6, which fixes the issue.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/apache/incubator-answer | <1.3.6 | 1.3.6 |
| Apache Answer | <1.3.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-41890?
The severity of CVE-2024-41890 is classified as medium due to potential exposure from multiple password reset emails within the link's validity period.
How do I fix CVE-2024-41890?
To fix CVE-2024-41890, update your Apache Answer installation to version 1.3.6 or later.
What versions of Apache Answer are affected by CVE-2024-41890?
CVE-2024-41890 affects Apache Answer versions through 1.3.5.
What types of attacks can CVE-2024-41890 lead to?
CVE-2024-41890 can potentially lead to unauthorized access due to multiple valid password reset links being issued.
Is CVE-2024-41890 present in the latest version of Apache Answer?
No, CVE-2024-41890 is not present in Apache Answer version 1.3.6 or later.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-41890
- agent/first-publish-date
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/references
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-gvpv-r32v-9737
- agent/software-canonical-lookup
- collector/github-advisory
- collector/nvd-api
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/trending
- agent/source
- package-manager/go
- vendor/apache
- canonical/apache answer