cve-2024-26578
Vulnerability from cvelistv5
Published
2024-02-22 09:28
Modified
2024-08-02 00:07
Severity ?
Summary
Apache Answer: Repeated submission at registration created duplicate users with the same name
References
security@apache.orghttp://www.openwall.com/lists/oss-security/2024/02/22/3
security@apache.orghttps://lists.apache.org/thread/ko0ksnznt2484lxt0zts2ygr82ldkhcb
Impacted products
Apache Software FoundationApache Answer
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26578",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-22T18:08:28.840287Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:57.385Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:07:19.622Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/ko0ksnznt2484lxt0zts2ygr82ldkhcb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/02/22/3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Answer",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Mohammad Reza Omrani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability in Apache Answer.\u003cp\u003eThis issue affects Apache Answer: through 1.2.1.\u003c/p\u003eRepeated submission during registration resulted in the registration of the same user. When users register, if they rapidly submit multiple registrations using scripts, it can result in the creation of multiple user accounts simultaneously with the same name.\u003cbr\u003e\u003cp\u003eUsers are recommended to upgrade to version [1.2.5], which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1.\n\nRepeated submission during registration resulted in the registration of the same user. When users register, if they rapidly submit multiple registrations using scripts, it can result in the creation of multiple user accounts simultaneously with the same name.\nUsers are recommended to upgrade to version [1.2.5], which fixes the issue.\n\n"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-22T09:28:15.274Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/ko0ksnznt2484lxt0zts2ygr82ldkhcb"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/02/22/3"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Answer: Repeated submission at registration created duplicate users with the same name",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-26578",
    "datePublished": "2024-02-22T09:28:15.274Z",
    "dateReserved": "2024-02-19T07:28:17.523Z",
    "dateUpdated": "2024-08-02T00:07:19.622Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26578\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2024-02-22T10:15:08.503\",\"lastModified\":\"2024-02-22T19:07:27.197\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1.\\n\\nRepeated submission during registration resulted in the registration of the same user. When users register, if they rapidly submit multiple registrations using scripts, it can result in the creation of multiple user accounts simultaneously with the same name.\\nUsers are recommended to upgrade to version [1.2.5], which fixes the issue.\\n\\n\"},{\"lang\":\"es\",\"value\":\"Ejecuci\u00f3n simult\u00e1nea mediante recurso compartido con vulnerabilidad de sincronizaci\u00f3n incorrecta (\u0027Condici\u00f3n de Ejecuci\u00f3n\u0027) en Apache Answer. Este problema afecta a Apache Answer: hasta 1.2.1. El env\u00edo repetido durante el registro result\u00f3 en el registro del mismo usuario. Cuando los usuarios se registran, si env\u00edan r\u00e1pidamente varios registros utilizando scripts, puede resultar en la creaci\u00f3n de varias cuentas de usuario simult\u00e1neamente con el mismo nombre. Se recomienda a los usuarios actualizar a la versi\u00f3n [1.2.5], que soluciona el problema.\"}],\"metrics\":{},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2024/02/22/3\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread/ko0ksnznt2484lxt0zts2ygr82ldkhcb\",\"source\":\"security@apache.org\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.