← Vulnerability feed

Vulnerability record · CVE-2024-40761 · published 25 September 2024

CVE-2024-40761: Apache answer inadequate encryption strength vulnerability

Apache · Answer

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

5.3 CVSS 3.1 Medium EPSS 0.75% · top 46.9% CWE-326 · Inadequate encryption strength
5.3CVSS 3.1 base score
0.75%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References
17 Jun 2026Last modified by NVD

Description

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread/mmrhsfy16qwrw0pkv0p9kj40vy3sg08x Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2024/09/25/2 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/25/5 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/25/6 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/25/7 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/25/8 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/26/1 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/26/3 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/26/4 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/27/4 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/27/5 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/09/27/8 Mailing ListThird Party Advisory

Track CVE-2024-40761 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2026-60053Apache answer insufficient session expiration vulnerabilityInsufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usa…EPSS 0.57%9.1CVE-2024-22393Apache answer unrestricted file upload vulnerabilityUnrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Pixel Flood Attack by…EPSS 2.5%7.5CVE-2026-60023Apache answer information exposure vulnerabilityExposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Deleted o…EPSS 0.62%7.5CVE-2026-48911Apache answer missing authentication for critical function vulnerabilityInsufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorizati…EPSS 0.58%7.5CVE-2026-48834Apache answer uncontrolled resource consumption vulnerabilityImproper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated …EPSS 0.76%7.5CVE-2026-24735Apache answer vulnerabilityExposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 1.7.1. An…EPSS 0.63%7.2CVE-2026-25700Apache answer vulnerabilityImproper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued …EPSS 0.65%6.5CVE-2026-48912Apache answer insecure direct object reference vulnerabilityImproper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in the avatar-cl…EPSS 0.47%

Source: NIST National Vulnerability Database (record CVE-2024-40761), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.