CVE-2024-41890
published 2024-08-12CVE-2024-41890: Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
1.15%
63.2th percentile
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.3.5.
User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked.
Users are recommended to upgrade to version 1.3.6, which fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | answer | < 1.3.6 | 1.3.6 |
| apache_software_foundation | apache_answer | <= 1.3.5 | — |
| github.com | apache_incubator-answer | >= 0 < 1.3.6 | 1.3.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache Answer: The link to reset the user's password will remain valid after sending a new link in github.com/apache/incubator-answer
osv·2024-08-13
CVE-2024-41890 Apache Answer: The link to reset the user's password will remain valid after sending a new link in github.com/apache/incubator-answer
Apache Answer: The link to reset the user's password will remain valid after sending a new link in github.com/apache/incubator-answer
Apache Answer: The link to reset the user's password will remain valid after sending a new link in github.com/apache/incubator-answer
GHSA
Apache Answer: The link to reset the user's password will remain valid after sending a new link
ghsa·2024-08-12
CVE-2024-41890 [MEDIUM] CWE-772 Apache Answer: The link to reset the user's password will remain valid after sending a new link
Apache Answer: The link to reset the user's password will remain valid after sending a new link
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.3.5.
User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked.
Users are recommended to upgrade to version 1.3.6, which fixes the issue.
OSV
Apache Answer: The link to reset the user's password will remain valid after sending a new link
osv·2024-08-12
CVE-2024-41890 [MEDIUM] Apache Answer: The link to reset the user's password will remain valid after sending a new link
Apache Answer: The link to reset the user's password will remain valid after sending a new link
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.3.5.
User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked.
Users are recommended to upgrade to version 1.3.6, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-08-12
Published