CVE-2024-41888
published 2024-08-12CVE-2024-41888: Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
1.22%
65.2th percentile
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.3.5.
The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked.
Users are recommended to upgrade to version 1.3.6, which fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | answer | < 1.3.6 | 1.3.6 |
| apache_software_foundation | apache_answer | <= 1.3.5 | — |
| github.com | apache_incubator-answer | >= 0 < 1.3.6 | 1.3.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache Answer: The link for resetting user password is not Single-Use in github.com/apache/incubator-answer
osv·2024-08-13
CVE-2024-41888 Apache Answer: The link for resetting user password is not Single-Use in github.com/apache/incubator-answer
Apache Answer: The link for resetting user password is not Single-Use in github.com/apache/incubator-answer
Apache Answer: The link for resetting user password is not Single-Use in github.com/apache/incubator-answer
GHSA
Apache Answer: The link for resetting user password is not Single-Use
ghsa·2024-08-12
CVE-2024-41888 [MEDIUM] CWE-772 Apache Answer: The link for resetting user password is not Single-Use
Apache Answer: The link for resetting user password is not Single-Use
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.3.5.
The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked.
Users are recommended to upgrade to version 1.3.6, which fixes the issue.
OSV
Apache Answer: The link for resetting user password is not Single-Use
osv·2024-08-12
CVE-2024-41888 [MEDIUM] Apache Answer: The link for resetting user password is not Single-Use
Apache Answer: The link for resetting user password is not Single-Use
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.3.5.
The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked.
Users are recommended to upgrade to version 1.3.6, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-08-12
Published