Apache Answer: XSS vulnerability when changing personal website

MOYENNE 4.6CVE-2024-29217 · GHSA-cvqr-mwh6-2vc6 · GO-2024-2743 · Published 21/04/2024 · updated 17/06/2026

En bref

CVE-2024-29217 est une vulnérabilité MOYENNE (CVSS 4.6) touchant github.com/apache/incubator-answer, answer (apache).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.97%, plus élevée que 61.7% des vulnérabilités.
Correctif : mettre à jour vers 1.3.0 ou plus récent.

Package	Affected versions	Patched versions
github.com/apache/incubator-answer Go	`< 1.3.0`	`1.3.0`
answer apache	`< 1.3.0`	`1.3.0`

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'/XSS) vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0.

XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-29217 · ADVISORY
apache/incubator-answer · PACKAGE
lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x · WEB
openwall.com/lists/oss-security/2024/04/19/1 · WEB

Autres vulnérabilités de github.com/apache/incubator-answer

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/apache/incubator-answer

< 1.3.0

1.3.0

answer

apache