CVE-2024-41890mediumCWE-772

CVE-2024-41890: medium-severity vulnerability in Apache Answer

Apache Answer: The link to reset the user's password will remain valid after sending a new link

Published · Updated

Follow this CVE+ Monitor Apache Answer+ Monitor github.com/apache/incubator-answer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 1.1%
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked. Users are recommended to upgrade to version 1.3.6, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Apache Software Foundation · Apache Answer
Related CVEs — Apache Answer

In the same product, most dangerous first.

CVE-2024-22393CRITICALApache Answer: Pixel Flood Attack by uploading the large pixel fileEPSS 2.5%CVE-2024-41888MEDIUMApache Answer: The link for resetting user password is not Single-UseEPSS 1.2%CVE-2024-23349MEDIUMApache Answer: XSS vulnerability when submitting summaryEPSS 1.1%CVE-2025-29868MEDIUMApache Answer: Using externally referenced images can leak user privacy.EPSS 1.0%CVE-2024-29217MEDIUMApache Answer: XSS vulnerability when changing personal websiteEPSS 1.0%CVE-2024-26578MEDIUMApache Answer: Repeated submission at registration created duplicate users with the same nameEPSS 0.9%