CVE-2024-29217

low-risk

Published 2024-04-21

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.

Do I need to act?

0.38% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.6/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Answer

Affected Vendors

Apache

References (4)

Mailing List http://www.openwall.com/lists/oss-security/2024/04/19/1

Mailing List https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x

Mailing List http://www.openwall.com/lists/oss-security/2024/04/19/1

Mailing List https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x

/ 100

low-risk

Severity 19/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal