CVE-2024-22393

high-risk
Published 2024-02-22

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Pixel Flood Attack by uploading large pixel files will cause server out of memory. A logged-in user can cause such an attack by uploading an image when posting content. Users are recommended to upgrade to version [1.2.5], which fixes the issue.

Do I need to act?

!
26.7% chance of exploitation in next 30 days
EPSS score — higher than 73% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.1/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Answer

Affected Vendors

Apache

References (4)

Third Party Advisory http://www.openwall.com/lists/oss-security/2024/02/22/1
Vendor Advisory https://lists.apache.org/thread/f58l6dr4r74hl6o71gn47kmn44vw12cv
Third Party Advisory http://www.openwall.com/lists/oss-security/2024/02/22/1
Vendor Advisory https://lists.apache.org/thread/f58l6dr4r74hl6o71gn47kmn44vw12cv
51
/ 100
high-risk
Severity 31/34 · Critical
Exploitability 15/34 · Moderate
Exposure 5/34 · Minimal