CVE-2024-40761

—

CVSS 3.1

5.3 medium

EPSS

<1%p53

Published

Sep 25, 2024 (Sep 25, 2024)

Modified

Jun 17, 2026

Description

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Vendors: apache
Products: answer
Weakness: CWE-326
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.