Apache Answer: XSS vulnerability when changing personal website

Apache Answer, a Q&A platform, is affected by a stored cross-site scripting (XSS) vulnerability identified as CVE-2024-29217. The root cause is improper neutralization of user-supplied input in the personal website field during profile modification [1][2]. This allows a logged-in user to inject arbitrary JavaScript or HTML code into that field [2].

To exploit the vulnerability, an attacker must be an authenticated user with the ability to edit their profile. While modifying their personal website URL, they can submit malicious code as part of the value. The application fails to sanitize or encode this input before storing it and later rendering it in web pages [1]. The attack does not require any special privileges beyond a standard user account [2].

When the injected content is rendered in a browser (e.g., when another user views the attacker's profile or the personal website link is displayed), the malicious script executes in the context of the victim's session. This can lead to data theft, session hijacking, or other actions impersonating the victim [1][2]. The severity is marked as important [2].

The vulnerability affects Apache Answer versions before 1.3.0. The fix was released in version 1.3.0, and users are strongly advised to upgrade immediately [1][2]. No workarounds are provided, and upgrading is the recommended mitigation.