CVE-2024-22393

CRITICAL

Apache Answer < 1.2.5 - Authenticated Denial of Service via Large Pixel File Upload

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2024-22393. PoCs published by Rk-000, omranisecurity.

AI-analyzed exploit summary This repository contains a Python-based scanner tool designed to detect Apache servers and Apache Answer installations by analyzing server headers, page content, and common paths. It does not include exploit code but focuses on identification and fingerprinting.

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Pixel Flood Attack by uploading large pixel files will cause server out of memory. A logged-in user can cause such an attack by uploading an image when posting content. Users are recommended to upgrade to version [1.2.5], which fixes the issue.

Exploits (3)

nomisec SCANNER 1 stars
by Rk-000 · poc
https://github.com/Rk-000/Apache-Hunter

This repository contains a Python-based scanner tool designed to detect Apache servers and Apache Answer installations by analyzing server headers, page content, and common paths. It does not include exploit code but focuses on identification and fingerprinting.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Apache HTTP Server, Apache Answer
No auth needed
Prerequisites: network access to target server
devstral-2 · analyzed Mar 10, 2026 Full analysis →
nomisec WORKING POC 1 stars
by Rk-000 · poc
https://github.com/Rk-000/Pixel-Flood-Attack

This repository contains a functional PoC for CVE-2024-22393, a memory exhaustion vulnerability in Apache Answer. The exploit involves uploading a crafted image with falsified EXIF metadata to trigger a DoS condition.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Apache Answer (versions up to 1.2.1)
Auth required
Prerequisites: Valid user account on the target application · Image upload functionality accessible
devstral-2 · analyzed Mar 10, 2026 Full analysis →
nomisec SUSPICIOUS
by omranisecurity · poc
https://github.com/omranisecurity/CVE-2024-22393

The repository claims to exploit CVE-2024-22393 but only provides a link to an external image file without any technical details or exploit code. This is characteristic of a social engineering lure.

Classification
Suspicious 90%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: unknown
No auth needed
Prerequisites: none provided
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 9.1
EPSS 0.2673
EPSS Percentile 96.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-434
Status published
Products (2)
apache/answer < 1.2.5
apache/incubator-answer 0 - 1.2.5Go
Published Feb 22, 2024
Tracked Since Feb 18, 2026