Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-41888

Date: August 9, 2024

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked. Users are recommended to upgrade to version 1.3.6, which fixes the issue.

Language: Go

Severity Score

Related Resources (7)

github.com/apache/incubator-answer
https://lists.apache.org/thread/jbs1j2o9rqm5sc19jyk3jcfvkmfkmyf4
http://www.openwall.com/lists/oss-security/2024/08/09/5
https://nvd.nist.gov/vuln/detail/CVE-2024-41888
https://github.com/advisories/GHSA-v3x9-wrq5-868j
https://github.com/apache/incubator-answer/commit/2820efc454f5808974dce0aa99aac106be3f727b
https://www.mend.io/vulnerability-database/CVE-2024-41888

Severity Score

Weakness Type (CWE)

Missing Release of Resource after Effective Lifetime

CWE-772

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us