Approved changes feed: RSS · Atom
cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Answer (1c52c1c2-3b4b-5ac4-b1de-227370d18aa8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/apache/incubator-answer |
purl2cpe | 2026-06-01 10:14:30.418097 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-24735 |
vulnerable | 2026-06-08 07:51:18.094272 |
Apache Answer: Revision API Improper Access Control leads to Information Disclosure
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.7.1.
An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized user to retrieve restricted or sensitive information.
Users are recommended to upgrade to version 2.0.0, which fixes the issue.
Published: 2026-02-04T10:41:58.990Z
Updated: 2026-02-04T18:15:12.318Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-29868 |
vulnerable | 2026-06-08 07:14:56.880354 |
Apache Answer: Using externally referenced images can leak user privacy.
Private Data Structure Returned From A Public Method vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.4.2.
If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of that accessing user.
Users are recommended to upgrade to version 1.4.5, which fixes the issue. In the new version, administrators can set whether external content can be displayed.
Published: 2025-04-01T07:56:28.633Z
Updated: 2025-04-10T15:03:07.021Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45719 |
vulnerable | 2026-06-08 06:48:08.949008 |
Apache Answer: Predictable Authorization Token Using UUIDv1
Inadequate Encryption Strength vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.4.0.
The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable.
Users are recommended to upgrade to version 1.4.1, which fixes the issue.
Published: 2024-11-22T14:36:44.588Z
Updated: 2024-11-22T20:18:15.264Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41890 |
vulnerable | 2026-06-08 06:43:55.419821 |
Apache Answer: The link to reset the user's password will remain valid after sending a new link
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.3.5.
User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked.
Users are recommended to upgrade to version 1.3.6, which fixes the issue.
Published: 2024-08-09T14:53:28.544Z
Updated: 2025-03-13T18:27:24.551Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41888 |
vulnerable | 2026-06-08 06:43:55.413942 |
Apache Answer: The link for resetting user password is not Single-Use
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.3.5.
The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked.
Users are recommended to upgrade to version 1.3.6, which fixes the issue.
Published: 2024-08-09T14:55:14.493Z
Updated: 2025-03-13T19:53:24.691Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-40761 |
vulnerable | 2026-06-08 06:43:53.137506 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29217 |
vulnerable | 2026-06-08 06:33:29.029241 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-26578 |
vulnerable | 2026-06-08 06:31:26.501927 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-23349 |
vulnerable | 2026-06-08 06:29:37.340193 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-22393 |
vulnerable | 2026-06-08 06:29:34.816339 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-49619 |
vulnerable | 2026-06-08 06:14:29.261694 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.