GHSA-wqcc-mfhw-53pc

Source

https://github.com/advisories/GHSA-wqcc-mfhw-53pc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-wqcc-mfhw-53pc/GHSA-wqcc-mfhw-53pc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wqcc-mfhw-53pc

Aliases

CVE-2025-29868
GO-2025-3587

Published

2025-04-01T09:30:20Z

Modified

2025-04-02T16:57:01.239177Z

Severity

1.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

Apache Answer User Using External Images Potentially Discloses User Information

Details

Private Data Structure Returned From A Public Method vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.4.2.

If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of that accessing user. Users are recommended to upgrade to version 1.4.5, which fixes the issue. In the new version, administrators can set whether external content can be displayed.

Database specific

{
    "nvd_published_at": "2025-04-01T08:15:14Z",
    "cwe_ids": [
        "CWE-495"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-01T18:20:03Z"
}

References

Affected packages

Go / github.com/apache/answer

Package

Name: github.com/apache/answer; View open source insights on deps.dev
Purl: pkg:golang/github.com/apache/answer

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.4.5