CVE-2023-1975
published 2023-04-11CVE-2023-1975: Insertion of Sensitive Information Into Sent Data in GitHub repository answerdev/answer prior to 1.0.8.
PriorityP430medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
0.59%
43.6th percentile
Insertion of Sensitive Information Into Sent Data in GitHub repository answerdev/answer prior to 1.0.8.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| answer | answer | < 1.0.8 | 1.0.8 |
| answerdev | answerdev_answer | >= unspecified < 1.0.8 | 1.0.8 |
| github.com | answerdev_answer | >= 0 < 1.0.8 | 1.0.8 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv3.07.6HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Answer vulnerable to Insertion of Sensitive Information Into Sent Data in github.com/answerdev/answer
osv·2024-08-20
CVE-2023-1975 Answer vulnerable to Insertion of Sensitive Information Into Sent Data in github.com/answerdev/answer
Answer vulnerable to Insertion of Sensitive Information Into Sent Data in github.com/answerdev/answer
Answer vulnerable to Insertion of Sensitive Information Into Sent Data in github.com/answerdev/answer
OSV
Answer vulnerable to Insertion of Sensitive Information Into Sent Data
osv·2023-04-11
CVE-2023-1975 [MEDIUM] Answer vulnerable to Insertion of Sensitive Information Into Sent Data
Answer vulnerable to Insertion of Sensitive Information Into Sent Data
answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.8 does not strip EXIF geolocation data from user-uploaded logos. As a result, anyone can get sensitive information like a user's device ID, geolocation, system information, system version, etc.
GHSA
Answer vulnerable to Insertion of Sensitive Information Into Sent Data
ghsa·2023-04-11
CVE-2023-1975 [MEDIUM] CWE-201 Answer vulnerable to Insertion of Sensitive Information Into Sent Data
Answer vulnerable to Insertion of Sensitive Information Into Sent Data
answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.8 does not strip EXIF geolocation data from user-uploaded logos. As a result, anyone can get sensitive information like a user's device ID, geolocation, system information, system version, etc.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-04-11
Published