CVE-2024-29217

{"id": "CVE-2024-29217", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.1}]}, "published": "2024-04-21T16:15:47.617", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/04/19/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/19/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x", "tags": ["Mailing List", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0.\n\nXSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack.\nUsers are recommended to upgrade to version [1.3.0], which fixes the issue."}, {"lang": "es", "value": "Neutralizaci\u00f3n inadecuada de la entrada durante la vulnerabilidad de generaci\u00f3n de p\u00e1ginas web ('cross-site Scripting') en Apache Answer. Este problema afecta a Apache Answer: versiones anteriores a 1.3.0. Ataque XSS cuando el usuario cambia de sitio web personal. Un usuario que haya iniciado sesi\u00f3n, al modificar su sitio web personal, puede introducir c\u00f3digo malicioso en el sitio web para crear dicho ataque. Se recomienda a los usuarios actualizar a la versi\u00f3n [1.3.0], que soluciona el problema."}], "lastModified": "2025-06-30T13:41:02.870", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2CD6F87A-D2DE-4FB2-869D-7B3AD8565BE0", "versionEndExcluding": "1.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}