CVE-2024-41888

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked. Users are recommended to upgrade to version 1.3.6, which fixes the issue.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/jbs1j2o9rqm5sc19jyk3jcfvkmfkmyf4	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/08/09/5

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*

History

21 Nov 2024, 09:33

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2024/08/09/5 -

29 Aug 2024, 12:55

Type	Values Removed	Values Added
CPE		cpe:2.3:a:apache:answer::::::::
References	~~() https://lists.apache.org/thread/jbs1j2o9rqm5sc19jyk3jcfvkmfkmyf4 -~~	() https://lists.apache.org/thread/jbs1j2o9rqm5sc19jyk3jcfvkmfkmyf4 - Mailing List, Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3
First Time		Apache Apache answer
Summary		(es) Falta la versión de recurso después de la vulnerabilidad de duración efectiva en Apache Answer. Este problema afecta a Apache Answer: hasta 1.3.5. El enlace para restablecer la contraseña sigue siendo válido dentro de su período de vencimiento, incluso después de haber sido utilizado. Esto podría provocar un uso indebido o un secuestro del enlace. Se recomienda a los usuarios actualizar a la versión 1.3.6, que soluciona el problema.

12 Aug 2024, 13:41

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-12 13:38

Updated : 2025-03-13 20:15

NVD link : CVE-2024-41888

Mitre link : CVE-2024-41888

CVE.ORG link : CVE-2024-41888

JSON object : View

Products Affected

apache

answer

CWE

CWE-772

Missing Release of Resource after Effective Lifetime

{"id": "CVE-2024-41888", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-08-12T13:38:31.617", "references": [{"url": "https://lists.apache.org/thread/jbs1j2o9rqm5sc19jyk3jcfvkmfkmyf4", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2024/08/09/5", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-772"}]}], "descriptions": [{"lang": "en", "value": "Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.3.5.\n\nThe password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked.\nUsers are recommended to upgrade to version 1.3.6, which fixes the issue."}, {"lang": "es", "value": "Falta la versi\u00f3n de recurso despu\u00e9s de la vulnerabilidad de duraci\u00f3n efectiva en Apache Answer. Este problema afecta a Apache Answer: hasta 1.3.5. El enlace para restablecer la contrase\u00f1a sigue siendo v\u00e1lido dentro de su per\u00edodo de vencimiento, incluso despu\u00e9s de haber sido utilizado. Esto podr\u00eda provocar un uso indebido o un secuestro del enlace. Se recomienda a los usuarios actualizar a la versi\u00f3n 1.3.6, que soluciona el problema."}], "lastModified": "2025-03-13T20:15:22.213", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43EA3C87-1BF0-4544-9DAA-A0B3D8D4EA1B", "versionEndExcluding": "1.3.6"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}