Cross-site Scripting (XSS) - Stored in answerdev/answer

CVE-2023-1536 is a stored cross-site scripting (XSS) vulnerability in the Answer Q&A platform, prior to version 1.0.7. The root cause is insufficient sanitization of Markdown input, which allows an attacker to include arbitrary HTML or JavaScript code in content that is later rendered to other users [1][2]. The fix implemented in commit c3743bad updates the Markdown parser to properly escape or strip dangerous XSS vectors [1].

An attacker can exploit this vulnerability by submitting a question, answer, or comment containing malicious Markdown. No authentication is strictly required if the platform allows anonymous contributions; otherwise, an authenticated user on the platform can still target other users who view the injected content. Since the injection is stored and persists on the server, every visitor to the affected page will execute the injected script, increasing the attack surface [2][4].

The impact of a successful exploit includes session theft, credential harvesting, defacement, or redirection to malicious sites. Because Answer is used as a community forum, help center, or knowledge management platform [3], the XSS can be used to compromise administrative accounts or exfiltrate sensitive internal information stored within the platform [4].

Apache Answer (formerly answerdev/answer) released version 1.0.7 to address this vulnerability. Users are strongly advised to upgrade immediately, as no workaround is documented. The vulnerability has been assigned a CVSS score of 6.1 (Medium) and was publicly disclosed via huntr.dev on March 21, 2023 [2][4].