Apache Answer: XSS vulnerability when changing personal website

MEDIUM 4.6CVE-2024-29217 · GHSA-cvqr-mwh6-2vc6 · GO-2024-2743 · Published 21/04/2024 · updated 17/06/2026

In short

CVE-2024-29217 is a MEDIUM (CVSS 4.6) vulnerability affecting github.com/apache/incubator-answer, answer (apache).
Chance of exploitation in the next 30 days (EPSS): 0.97%, higher than 61.7% of all vulnerabilities.
Fix: update to 1.3.0 or later.

Package	Affected versions	Patched versions
github.com/apache/incubator-answer Go	`< 1.3.0`	`1.3.0`
answer apache	`< 1.3.0`	`1.3.0`

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'/XSS) vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0.

XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-29217 · ADVISORY
apache/incubator-answer · PACKAGE
lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x · WEB
openwall.com/lists/oss-security/2024/04/19/1 · WEB

More vulnerabilities in github.com/apache/incubator-answer

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/apache/incubator-answer

< 1.3.0

1.3.0

answer

apache