CVE-2024-29217

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-29217
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.

4.6 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/04/19/1 Mailing List Third Party Advisory
https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/04/19/1 Mailing List Third Party Advisory
https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*
History

30 Jun 2025, 13:41

Type Values Removed Values Added
First Time Apache answer
Apache
CPE cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*
References () http://www.openwall.com/lists/oss-security/2024/04/19/1 - () http://www.openwall.com/lists/oss-security/2024/04/19/1 - Mailing List, Third Party Advisory
References () https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x - () https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x - Mailing List, Vendor Advisory

13 Feb 2025, 18:17

Type Values Removed Values Added
Summary (en) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue. (en) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.
Information

Published : 2024-04-21 16:15

Updated : 2025-06-30 13:41

NVD link : CVE-2024-29217

Mitre link : CVE-2024-29217

CVE.ORG link : CVE-2024-29217

JSON object : View

Products Affected

apache

  • answer
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')