GHSA-gvpv-r32v-9737MediumCVSS 4.8

Apache Answer: The link to reset the user's password will remain valid after sending a new link

Published
August 12, 2024
Last Modified
March 13, 2025

🔗 CVE IDs covered (1)

CVE-2024-41890 →

📋 Description

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.3.5.

User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked. Users are recommended to upgrade to version 1.3.6, which fixes the issue.

🎯 Affected products1

  • go/github.com/apache/incubator-answer:< 1.3.6

🔗 References (5)