CVE-2024-40761
Apache Answer: Avatar URL leaked user email addresses
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Inadequate Encryption Strength vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.3.5.
Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Vulnerabilidad de fuerza de cifrado inadecuada en Apache Answer. Este problema afecta a Apache Answer: hasta la versión 1.3.5. El uso del valor MD5 del correo electrónico de un usuario para acceder a Gravatar es inseguro y puede provocar la filtración del correo electrónico del usuario. La recomendación oficial es utilizar SHA256 en su lugar. Se recomienda a los usuarios que actualicen a la versión 1.4.0, que soluciona el problema.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-07-10 CVE Reserved
- 2024-09-25 CVE Published
- 2024-09-26 EPSS Updated
- 2024-09-27 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-326: Inadequate Encryption Strength
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://lists.apache.org/thread/mmrhsfy16qwrw0pkv0p9kj40vy3sg08x | 2024-09-25 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apache Software Foundation Search vendor "Apache Software Foundation" | Apache Answer Search vendor "Apache Software Foundation" for product "Apache Answer" | <= 1.3.5 Search vendor "Apache Software Foundation" for product "Apache Answer" and version " <= 1.3.5" | en |
Affected
| ||||||