CVE-2024-29217mediumCWE-79

CVE-2024-29217: medium-severity vulnerability in Apache Answer

Apache Answer: XSS vulnerability when changing personal website

Published · Updated

Follow this CVE+ Monitor Apache Answer+ Monitor github.com/apache/incubator-answer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.6epss 1.0%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Affected products
Apache Software Foundation · Apache Answer
Related CVEs — Apache Answer

In the same product, most dangerous first.

CVE-2024-22393CRITICALApache Answer: Pixel Flood Attack by uploading the large pixel fileEPSS 2.5%CVE-2024-41888MEDIUMApache Answer: The link for resetting user password is not Single-UseEPSS 1.2%CVE-2024-41890MEDIUMApache Answer: The link to reset the user's password will remain valid after sending a new linkEPSS 1.1%CVE-2024-23349MEDIUMApache Answer: XSS vulnerability when submitting summaryEPSS 1.1%CVE-2025-29868MEDIUMApache Answer: Using externally referenced images can leak user privacy.EPSS 1.0%CVE-2024-26578MEDIUMApache Answer: Repeated submission at registration created duplicate users with the same nameEPSS 0.9%