{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-17T06:16:53.224","vulnerabilities":[{"cve":{"id":"CVE-2024-41890","sourceIdentifier":"security@apache.org","published":"2024-08-12T13:38:31.733","lastModified":"2025-03-13T19:15:47.500","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.3.5.\n\nUser sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked.\nUsers are recommended to upgrade to version 1.3.6, which fixes the issue."},{"lang":"es","value":"Falta la versión de recurso después de la vulnerabilidad de duración efectiva en Apache Answer. Este problema afecta a Apache Answer: hasta 1.3.5. El usuario envía varios correos electrónicos para restablecer la contraseña, cada uno de los cuales contiene un enlace válido. Dentro del período de validez del enlace, esto podría dar lugar a un uso indebido o un secuestro del mismo. Se recomienda a los usuarios actualizar a la versión 1.3.6, que soluciona el problema."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-772"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*","versionEndExcluding":"1.3.6","matchCriteriaId":"43EA3C87-1BF0-4544-9DAA-A0B3D8D4EA1B"}]}]}],"references":[{"url":"https://lists.apache.org/thread/j7c080xj31x8rvz1pyk2h47rdd9pwbv9","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/08/09/4","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}