Missing Release of Resource after Effective Lifetime
CVE-2024-41890
Summary
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer versions prior to v1.3.6-RC1. The user sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could lead to the link being misused or hijacked. This has the same fix as CVE-2024-41888.
- LOW
- NETWORK
- LOW
- UNCHANGED
- NONE
- NONE
- NONE
- NONE
CWE-772 - Missing Release Of Resource After Effective Lifetime
'Missing release of resource after effective lifetime' is a weakness that occurs when software doesn't sufficiently release a resource (e.g. memory, CPU, disk space, etc.) after it is used. If not addressed, attackers can launch a denial of service attack (by allocating a resource and not releasing it).
References
Advisory Timeline
- Published
