CVE-2024-45719
LOWApache Answer < 1.4.1 - Weak Encryption
Title source: ruleDescription
Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1, which fixes the issue.
Scores
CVSS v3
2.6
EPSS
0.0007
EPSS Percentile
20.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
Classification
CWE
CWE-326
Status
published
Affected Products (2)
apache/answer
< 1.4.1
apache/incubator-answer
< 1.4.1Go
Timeline
Published
Nov 22, 2024
Tracked Since
Feb 18, 2026