GHSA-gvpv-r32v-9737

Source

https://github.com/advisories/GHSA-gvpv-r32v-9737

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/08/GHSA-gvpv-r32v-9737/GHSA-gvpv-r32v-9737.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gvpv-r32v-9737

Aliases

Published

2024-08-12T15:30:50Z

Modified

2024-08-29T16:20:01Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Apache Answer: The link to reset the user's password will remain valid after sending a new link

Details

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.3.5.

User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked. Users are recommended to upgrade to version 1.3.6, which fixes the issue.

Database specific

{
    "nvd_published_at": "2024-08-12T13:38:31Z",
    "cwe_ids": [
        "CWE-772"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-12T18:33:30Z"
}

References

Affected packages

Go / github.com/apache/incubator-answer

Package

Name: github.com/apache/incubator-answer; View open source insights on deps.dev
Purl: pkg:golang/github.com/apache/incubator-answer

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.6