Apache Answer: XSS vulnerability when changing personal website

MÉDIO 4.6CVE-2024-29217 · GHSA-cvqr-mwh6-2vc6 · GO-2024-2743 · Published 21/04/2024 · updated 17/06/2026

Em resumo

CVE-2024-29217 é uma vulnerabilidade MÉDIO (CVSS 4.6) que afeta github.com/apache/incubator-answer, answer (apache).
Chance de exploração nos próximos 30 dias (EPSS): 0.97%, maior que 61.7% das vulnerabilidades.
Correção: atualize para 1.3.0 ou posterior.

Package	Affected versions	Patched versions
github.com/apache/incubator-answer Go	`< 1.3.0`	`1.3.0`
answer apache	`< 1.3.0`	`1.3.0`

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'/XSS) vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0.

XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-29217 · ADVISORY
apache/incubator-answer · PACKAGE
lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x · WEB
openwall.com/lists/oss-security/2024/04/19/1 · WEB

Mais vulnerabilidades de github.com/apache/incubator-answer

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/apache/incubator-answer

< 1.3.0

1.3.0

answer

apache