CVE-2024-29217

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0.

XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Answer	< 1.3.0
apache	answer	-

References

http://www.openwall.com/lists/oss-security/2024/04/19/1Mailing List, Third Party Advisory
https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0xMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/04/19/1Mailing List, Third Party Advisory
https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0xMailing List, Vendor Advisory

Timeline

Published: Apr 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-292188.8Out-of-bounds write vulnerability exists in KV STUDIO Ver.11.64 and earlier, KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver.6.CVE-2024-292197.8Out-of-bounds read vulnerability exists in KV STUDIO Ver.11.64 and earlier and KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver.CVE-2024-29225.4The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget tags in all versions up to,CVE-2024-292206.1Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an CVE-2024-292213.8Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked CVE-2024-292226.1Out-of-bounds write for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable denial of service via l CVE-2024-292237.8Uncontrolled search path for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potential CVE-2024-292249.8An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary co CVE-2024-292254.3ELECOM wireless LAN routers allow a network-adjacent unauthenticated attacker to obtain the configuration file containing sensitive informat CVE-2024-292275.4Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Layout.LayoutSave webapi component in CVE-2024-292287.7Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 all CVE-2024-292297.7Missing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 a