CVE-2025-29868

Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of that accessing user. Users are recommended to upgrade to version 1.4.5, which fixes the issue. In the new version, administrators can set whether external content can be displayed.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/l7pohw5g03g3qsvrz8pqc9t29mdv5lhf	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/04/01/2	Mailing List
http://www.openwall.com/lists/oss-security/2025/04/02/1	Mailing List
http://www.openwall.com/lists/oss-security/2025/04/10/3	Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-04-01 08:15

Updated : 2025-04-15 13:07

NVD link : CVE-2025-29868

Mitre link : CVE-2025-29868

CVE.ORG link : CVE-2025-29868

JSON object : View

Products Affected

apache

answer

CWE

CWE-495

Private Data Structure Returned From A Public Method

{"id": "CVE-2025-29868", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2025-04-01T08:15:14.990", "references": [{"url": "https://lists.apache.org/thread/l7pohw5g03g3qsvrz8pqc9t29mdv5lhf", "tags": ["Mailing List", "Vendor Advisory"], "source": "[email protected]"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/01/2", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/02/1", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/10/3", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-495"}]}], "descriptions": [{"lang": "en", "value": "Private Data Structure Returned From A Public Method vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.4.2.\n\nIf a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of that accessing user.\nUsers are recommended to upgrade to version 1.4.5, which fixes the issue.\u00a0In the new version, administrators can set whether external content can be displayed."}, {"lang": "es", "value": "Vulnerabilidad de estructura de datos privada devuelta desde un m\u00e9todo p\u00fablico en Apache Answer. Este problema afecta a Apache Answer hasta la versi\u00f3n 1.4.2. Si un usuario utiliza una imagen referenciada externamente, al acceder a ella, el proveedor de la imagen podr\u00eda obtener informaci\u00f3n privada sobre la direcci\u00f3n IP del usuario. Se recomienda actualizar a la versi\u00f3n 1.4.5, que soluciona el problema. En la nueva versi\u00f3n, los administradores pueden configurar si se puede mostrar contenido externo."}], "lastModified": "2025-04-15T13:07:54.393", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29E2B105-1033-4FCE-8F05-20368605017D", "versionEndIncluding": "1.4.2"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}