GHSA-v3x9-wrq5-868j

Source

https://github.com/advisories/GHSA-v3x9-wrq5-868j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/08/GHSA-v3x9-wrq5-868j/GHSA-v3x9-wrq5-868j.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-v3x9-wrq5-868j

Aliases

Published

2024-08-12T15:30:50Z

Modified

2024-08-29T16:19:44Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Apache Answer: The link for resetting user password is not Single-Use

Details

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.3.5.

The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked. Users are recommended to upgrade to version 1.3.6, which fixes the issue.

Database specific

{
    "nvd_published_at": "2024-08-12T13:38:31Z",
    "cwe_ids": [
        "CWE-772"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-12T18:33:35Z"
}

References

Affected packages

Go / github.com/apache/incubator-answer

Package

Name: github.com/apache/incubator-answer; View open source insights on deps.dev
Purl: pkg:golang/github.com/apache/incubator-answer

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.6