Apache Answer: XSS vulnerability when changing personal website

MITTEL 4.6CVE-2024-29217 · GHSA-cvqr-mwh6-2vc6 · GO-2024-2743 · Published 21/04/2024 · updated 17/06/2026

Kurz gesagt

CVE-2024-29217 ist eine Schwachstelle (MITTEL (CVSS 4.6)) in github.com/apache/incubator-answer, answer (apache).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.97%, höher als bei 61.7% aller Schwachstellen.
Abhilfe: auf 1.3.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
github.com/apache/incubator-answer Go	`< 1.3.0`	`1.3.0`
answer apache	`< 1.3.0`	`1.3.0`

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'/XSS) vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0.

XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-29217 · ADVISORY
apache/incubator-answer · PACKAGE
lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x · WEB
openwall.com/lists/oss-security/2024/04/19/1 · WEB

Weitere Schwachstellen in github.com/apache/incubator-answer

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/apache/incubator-answer

< 1.3.0

1.3.0

answer

apache