Answer vulnerable to account takeover because password reset links do not expire

높음 8.8CVE-2023-1976 · GHSA-j97g-77fj-9c4p · GO-2023-1719 · Published 11/04/2023 · updated 17/06/2026

요약

CVE-2023-1976은(는) github.com/answerdev/answer, answer (answer)에 영향을 주는 높음 (CVSS 8.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.61%, 전체 취약점의 49.0%보다 높음.
조치: 1.0.6 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
github.com/answerdev/answer Go	`< 1.0.6`	`1.0.6`
answer answer	`< 1.0.6`	`1.0.6`

Description

answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.6 is vulnerable to account takeover because the password reset link does not expire.

NVD description

Password Aging with Long Expiration in GitHub repository answerdev/answer prior to 1.0.6.

References

nvd.nist.gov/vuln/detail/CVE-2023-1976 · ADVISORY
answerdev/answer commit 813ad0b · WEB
answerdev/answer · PACKAGE
huntr.dev/bounties/469bcabf-b315-4750-b63c-82ac86d153de · WEB
GitHub Advisory GHSA-j97g-77fj-9c4p · ADVISORY

github.com/answerdev/answer의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/answerdev/answer

< 1.0.6

1.0.6

answer

< 1.0.6

1.0.6

github.com/answerdev/answer의 다른 취약점

모두 보기 →