VDB
KO
HIGH 7.2

GHSA-4gw2-vg4x-7p29

Apache Answer: AdminToken not invalidated after admin deactivation

Quick fix

GHSA-4gw2-vg4x-7p29 — github.com/apache/incubator-answer: upgrade to the fixed version with the command below. 

go get github.com/apache/incubator-answer@v2.0.1

Details

Improper Restriction of Security Token Assignment vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/apache/incubator-answer
Introduced in: 0 Fixed in: 2.0.1
Fix go get github.com/apache/incubator-answer@v2.0.1
Go / github.com/apache/answer
Introduced in: 0 Fixed in: 2.0.1
Fix go get github.com/apache/answer@v2.0.1

References