Apache Answer: XSS vulnerability when changing personal website

MEDIO 4.6CVE-2024-29217 · GHSA-cvqr-mwh6-2vc6 · GO-2024-2743 · Published 21/04/2024 · updated 17/06/2026

In breve

CVE-2024-29217 è una vulnerabilità MEDIO (CVSS 4.6) che riguarda github.com/apache/incubator-answer, answer (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.97%, superiore al 61.7% delle vulnerabilità.
Correzione: aggiornare a 1.3.0 o successiva.

Package	Affected versions	Patched versions
github.com/apache/incubator-answer Go	`< 1.3.0`	`1.3.0`
answer apache	`< 1.3.0`	`1.3.0`

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'/XSS) vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0.

XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-29217 · ADVISORY
apache/incubator-answer · PACKAGE
lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x · WEB
openwall.com/lists/oss-security/2024/04/19/1 · WEB

Altre vulnerabilità di github.com/apache/incubator-answer

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/apache/incubator-answer

< 1.3.0

1.3.0

answer

apache