CVE-2024-29217 Apache Answer: XSS vulnerability when changing personal website

2024-04-2116:04:10

CWE-79

apache

github.com

cve-2024-29217

apache answer

xss vulnerability

input neutralization

web page generation

upgrade

security issue

AI Score

6.9

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0.

XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack.
Users are recommended to upgrade to version [1.3.0], which fixes the issue.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:apache:answer:-:*:*:*:*:*:*:*"
    ],
    "vendor": "apache",
    "product": "answer",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ],
    "defaultStatus": "unknown"
  }
]