GitHub Advisoryadvisory · Go

GHSA-8pf2-qj4v-fj64 Apache Answer Cross-site Scripting vulnerability

MEDIUM Published 2024-02-22 Modified 2024-12-11 Official page ↗
Aliases
CVE-2024-23349
Ecosystem
Go
Packages
github.com/apache/incubator-answer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-02-22

Affected packages

• Go github.com/apache/incubator-answer: < 1.2.5 → fixed in 1.2.5

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects Apache Answer through 1.2.1. XSS attack when user enters summary. A logged-in user, when modifying their own submitted question, can input malicious code in the summary to create such an attack. Users are recommended to upgrade to version 1.2.5, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2024-23349 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References