oss-sec mailing list archives
CVE-2024-23349: Apache Answer: XSS vulnerability when submitting summary
From: Enxin Xie <linkinstar () apache org>
Date: Thu, 22 Feb 2024 07:36:40 +0000
Severity: important Affected versions: - Apache Answer through 1.2.1 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. XSS attack when user enters summary. A logged-in user, when modifying their own submitted question, can input malicious code in the summary to create such an attack. Users are recommended to upgrade to version [1.2.5], which fixes the issue. Credit: Lyaa@JeeseenSec (reporter) References: https://answer.incubator.apache.org https://www.cve.org/CVERecord?id=CVE-2024-23349
Current thread:
- CVE-2024-23349: Apache Answer: XSS vulnerability when submitting summary Enxin Xie (Feb 22)