Apache Answer
Monthly
Privileged API access in Apache Answer through 2.0.1 persists after an administrator loses their authority: keys issued to an admin stay valid even after the account is demoted, marked inactive, suspended, or deleted, so a former administrator retains full API-level control until the keys are manually purged. This CWE-613 (Insufficient Session Expiration) flaw carries a vendor CVSS of 9.1 and is fixed in 2.0.2. There is no public exploit identified at time of analysis and EPSS is low (0.16%), consistent with an insider/privilege-retention issue rather than mass internet exploitation.
Unauthenticated information disclosure in Apache Answer through 2.0.1 allows any remote user to retrieve deleted or pending answers via the single-answer read API path, provided the parent question remains publicly visible. The flaw bypasses moderation-state access controls, exposing content that was intentionally withheld from public view. No public exploit code or active exploitation has been identified; EPSS at 0.17% (7th percentile) reflects limited real-world exploitation interest despite the high CVSS score.
Account takeover in Apache Answer through 2.0.1 allows unauthenticated remote attackers to seize arbitrary user accounts by exploiting a missing authorization check in the external-login OAuth email binding workflow. The attacker crafts a malicious confirmation link and socially engineers a target into clicking it, after which the attacker's external identity is silently bound to the victim's Answer account. No active exploitation has been identified (CISA KEV absent, EPSS at 7th percentile), but the SSVC framework flags the attack as automatable, making phishing-at-scale campaigns mechanically feasible.
Denial of service in Apache Answer through 2.0.1 allows unauthenticated remote attackers to exhaust CPU resources by sending a specially crafted Accept-Language HTTP header that triggers runaway parsing logic. The root cause is improper handling of a length parameter inconsistency (CWE-400) during header processing, meaning any unauthenticated HTTP request reaching the application can be weaponized for resource exhaustion. No public exploit code or CISA KEV listing has been identified at time of analysis, and the Apache Software Foundation has released a remediated version 2.0.2.
Privilege persistence in Apache Answer through version 2.0.0 allows suspended, deleted, or deactivated administrator accounts to retain access to administrative APIs because previously issued tokens are not invalidated upon account state change. The flaw requires high-privilege access to obtain a token initially and carries a CVSS 7.2 with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis and SSVC marks exploitation as none.
Improper authorization in Apache Answer through version 2.0.1 allows any authenticated user to reject arbitrary pending edit-revisions without holding review permissions. The missing authorization check on the reject operation means content moderation controls are effectively bypassed by ordinary users, enabling disruption of the peer-review workflow. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Insecure Direct Object Reference (IDOR) in Apache Answer through version 2.0.1 allows any authenticated user to delete uploaded files belonging to other users by supplying arbitrary file URLs to the avatar-cleanup endpoint. The root cause is a missing ownership check in the file-deletion logic (CWE-639), meaning the application accepts a user-controlled file URL and acts on it without verifying the requesting user has authority over that resource. No public exploit has been identified at time of analysis, but the attack requires only a valid account, making it low-friction once an attacker has registered or compromised any user.
Privileged API access in Apache Answer through 2.0.1 persists after an administrator loses their authority: keys issued to an admin stay valid even after the account is demoted, marked inactive, suspended, or deleted, so a former administrator retains full API-level control until the keys are manually purged. This CWE-613 (Insufficient Session Expiration) flaw carries a vendor CVSS of 9.1 and is fixed in 2.0.2. There is no public exploit identified at time of analysis and EPSS is low (0.16%), consistent with an insider/privilege-retention issue rather than mass internet exploitation.
Unauthenticated information disclosure in Apache Answer through 2.0.1 allows any remote user to retrieve deleted or pending answers via the single-answer read API path, provided the parent question remains publicly visible. The flaw bypasses moderation-state access controls, exposing content that was intentionally withheld from public view. No public exploit code or active exploitation has been identified; EPSS at 0.17% (7th percentile) reflects limited real-world exploitation interest despite the high CVSS score.
Account takeover in Apache Answer through 2.0.1 allows unauthenticated remote attackers to seize arbitrary user accounts by exploiting a missing authorization check in the external-login OAuth email binding workflow. The attacker crafts a malicious confirmation link and socially engineers a target into clicking it, after which the attacker's external identity is silently bound to the victim's Answer account. No active exploitation has been identified (CISA KEV absent, EPSS at 7th percentile), but the SSVC framework flags the attack as automatable, making phishing-at-scale campaigns mechanically feasible.
Denial of service in Apache Answer through 2.0.1 allows unauthenticated remote attackers to exhaust CPU resources by sending a specially crafted Accept-Language HTTP header that triggers runaway parsing logic. The root cause is improper handling of a length parameter inconsistency (CWE-400) during header processing, meaning any unauthenticated HTTP request reaching the application can be weaponized for resource exhaustion. No public exploit code or CISA KEV listing has been identified at time of analysis, and the Apache Software Foundation has released a remediated version 2.0.2.
Privilege persistence in Apache Answer through version 2.0.0 allows suspended, deleted, or deactivated administrator accounts to retain access to administrative APIs because previously issued tokens are not invalidated upon account state change. The flaw requires high-privilege access to obtain a token initially and carries a CVSS 7.2 with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis and SSVC marks exploitation as none.
Improper authorization in Apache Answer through version 2.0.1 allows any authenticated user to reject arbitrary pending edit-revisions without holding review permissions. The missing authorization check on the reject operation means content moderation controls are effectively bypassed by ordinary users, enabling disruption of the peer-review workflow. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Insecure Direct Object Reference (IDOR) in Apache Answer through version 2.0.1 allows any authenticated user to delete uploaded files belonging to other users by supplying arbitrary file URLs to the avatar-cleanup endpoint. The root cause is a missing ownership check in the file-deletion logic (CWE-639), meaning the application accepts a user-controlled file URL and acts on it without verifying the requesting user has authority over that resource. No public exploit has been identified at time of analysis, but the attack requires only a valid account, making it low-friction once an attacker has registered or compromised any user.