CVE-2024-41890: Apache Answer Information Disclosure Flaw

CVE-2024-41890 Overview

CVE-2024-41890 is a resource management flaw in Apache Answer, an open-source question-and-answer platform. The vulnerability affects all versions through 1.3.5 and is tracked under CWE-772: Missing Release of Resource after Effective Lifetime. When a user requests multiple password reset emails, each generated link remains valid concurrently instead of invalidating prior tokens. An attacker who intercepts or otherwise obtains any active reset link within its validity window can hijack the reset flow. The Apache Software Foundation addressed the issue in Apache Answer 1.3.6.

Critical Impact
Concurrent password-reset tokens increase the window for account takeover if any reset link is misused, forwarded, or leaked in transit.

Affected Products

Apache Answer versions up to and including 1.3.5
Apache Answer deployments exposing password reset functionality over the network
Self-hosted community platforms running vulnerable Answer builds

Discovery Timeline

2024-08-12 - CVE-2024-41890 published to the National Vulnerability Database
2024-08-09 - Advisory distributed through the OpenWall OSS Security list
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41890

Vulnerability Analysis

Apache Answer generates a signed, time-limited link when a user requests a password reset. The application fails to invalidate previously issued reset tokens when a new request is submitted for the same account. Each token remains independently valid until its lifetime expires. This creates multiple simultaneously usable reset paths for a single account.

The flaw maps to CWE-772 because the application retains reset resources beyond their effective single-use lifetime. An attacker who obtains one of the parallel links through email forwarding, mailbox compromise, log exposure, or referrer leakage can complete the reset. The legitimate user experiences no visible interruption, which delays detection of the takeover.

Root Cause

The root cause is the absence of token revocation logic in the password reset workflow. Requesting a new reset does not expire or overwrite prior tokens stored server-side. Combined with a validity window intended for user convenience, this design allows several tokens to authenticate the same reset action concurrently.

Attack Vector

Exploitation requires no authentication and can be performed over the network. An attacker triggers multiple password reset requests for a target account or waits for the user to do so. If any single reset email is exposed within its validity period, the attacker submits that token to complete a password change. The vulnerability primarily impacts integrity by enabling unauthorized credential modification.

No verified public exploit code is available for CVE-2024-41890. Refer to the Apache mailing list advisory for the vendor description.

Detection Methods for CVE-2024-41890

Indicators of Compromise

Multiple password reset requests for the same account within a short window originating from different source addresses
Successful password change events preceded by reset link clicks from IP addresses that differ from the account's typical geolocation
Mail server logs showing repeated /password/reset template deliveries for a single user
Session activity from a new device immediately following a password change event

Detection Strategies

Correlate password reset request volume with successful reset completions per account to surface abnormal ratios
Alert on reset completions where the completing IP or User-Agent differs from the requesting IP or User-Agent
Monitor Apache Answer application logs for the reset token generation endpoint and flag repeated invocations against the same user identifier

Monitoring Recommendations

Ingest Apache Answer web server access logs and authentication events into a centralized analytics platform for longitudinal review
Track outbound reset emails from the SMTP relay and correlate with in-app reset events
Baseline normal password reset frequency per user and alert on statistical outliers

How to Mitigate CVE-2024-41890

Immediate Actions Required

Upgrade Apache Answer to version 1.3.6 or later, which invalidates prior reset tokens when a new request is issued
Audit recent password reset activity for accounts that received multiple reset emails within short timeframes
Force password resets and session invalidation for any accounts showing suspicious reset patterns

Patch Information

The Apache Answer maintainers released version 1.3.6 to fix CVE-2024-41890. The patch introduces server-side invalidation of previously issued reset tokens when a new reset request is generated. Deployment details are described in the Apache mailing list advisory.

Workarounds

Reduce the password reset token validity window through application configuration to minimize the exposure period
Restrict password reset endpoint access with rate limiting at a reverse proxy or web application firewall
Require additional out-of-band verification for password changes on privileged accounts until the upgrade is deployed

bash

# Example: rate limit the password reset endpoint at an nginx reverse proxy
limit_req_zone $binary_remote_addr zone=pwreset:10m rate=3r/m;

server {
    location /password/reset {
        limit_req zone=pwreset burst=5 nodelay;
        proxy_pass http://apache_answer_backend;
    }
}