cve.bz

CVE-2024-41890

5.3 mediumEPSS 1.1%

Medium (5.3) in apache answer. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in github.com/apache/incubator-answer 1.3.6.

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked. Users are recommended to upgrade to version 1.3.6, which fixes the issue.

Severity

CVSS 3.1

5.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS
1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE
CWE-772
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-gvpv-r32v-9737Gogithub.com/apache/incubator-answer<1.3.61.3.6
GO-2024-3064Gogithub.com/apache/incubator-answer<1.3.61.3.6

References

Check your stackJSON