What’s Vulnerable › Vulnerabilities

CVE-2024-29217: Apache Answer: XSS vulnerability when changing personal website

• Severity: medium (CVSS 4.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-21 · updated 2026-06-17
• Weakness: CWE-79

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.

Affected products

• Apache Software Foundation Apache Answer: before 1.3.0 — fixed in 1.3.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Answer 1.3.0. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/04/19/1
• https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x
• http://www.openwall.com/lists/oss-security/2024/04/19/1
• https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x

Get alerted when CVE-2024-29217 or the next vulnerability affects your stack