← Vulnerability feed

Vulnerability record · CVE-2024-22393 · published 22 February 2024

CVE-2024-22393: Apache answer unrestricted file upload vulnerability

Apache · Answer

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Pixel Flood Attack by uploading large pixel files will cause server out of memory. A logged-in user can cause such an attack by uploading an image when posting content. Users are recommended to upgrade to version [1.2.5], which fixes the issue.

9.1 CVSS 3.1 Critical EPSS 2.5% · top 16.2% CWE-434 · Unrestricted file upload
9.1CVSS 3.1 base score
2.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Pixel Flood Attack by uploading large pixel files will cause server out of memory. A logged-in user can cause such an attack by uploading an image when posting content. Users are recommended to upgrade to version [1.2.5], which fixes the issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.openwall.com/lists/oss-security/2024/02/22/1 Third Party Advisory
https://lists.apache.org/thread/f58l6dr4r74hl6o71gn47kmn44vw12cv Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/02/22/1 Third Party Advisory
https://lists.apache.org/thread/f58l6dr4r74hl6o71gn47kmn44vw12cv Vendor Advisory

Track CVE-2024-22393 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2026-60053Apache answer insufficient session expiration vulnerabilityInsufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usa…EPSS 0.57%7.5CVE-2026-60023Apache answer information exposure vulnerabilityExposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Deleted o…EPSS 0.62%7.5CVE-2026-48911Apache answer missing authentication for critical function vulnerabilityInsufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorizati…EPSS 0.58%7.5CVE-2026-48834Apache answer uncontrolled resource consumption vulnerabilityImproper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated …EPSS 0.76%7.5CVE-2026-24735Apache answer vulnerabilityExposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 1.7.1. An…EPSS 0.63%7.2CVE-2026-25700Apache answer vulnerabilityImproper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued …EPSS 0.65%6.5CVE-2026-48912Apache answer insecure direct object reference vulnerabilityImproper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in the avatar-cl…EPSS 0.47%6.5CVE-2026-50749Apache answer incorrect authorization vulnerabilityImproper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary p…EPSS 0.47%

Source: NIST National Vulnerability Database (record CVE-2024-22393), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.