GHSA-gvpv-r32v-9737

Suggest an improvement
Source
https://github.com/advisories/GHSA-gvpv-r32v-9737
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/08/GHSA-gvpv-r32v-9737/GHSA-gvpv-r32v-9737.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gvpv-r32v-9737
Aliases
Published
2024-08-12T15:30:50Z
Modified
2024-08-29T16:20:01Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Apache Answer: The link to reset the user's password will remain valid after sending a new link
Details

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.3.5.

User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked. Users are recommended to upgrade to version 1.3.6, which fixes the issue.

References

Affected packages

Go / github.com/apache/incubator-answer

Package

Name
github.com/apache/incubator-answer
View open source insights on deps.dev
Purl
pkg:golang/github.com/apache/incubator-answer

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.6