CVE-2024-45719CWE-326

Apache Answer: Predictable Authorization Token Using UUIDv1

Low · published November 22, 2024

CVSS v3.1
2.6
EPSS
0%
Percentile
15.2
In the wild
Unconfirmed
What it is

Inadequate Encryption Strength vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.4.0.

The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable.

Users are recommended to upgrade to version 1.4.1, which fixes the issue.

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00248 · 15.2th percentile
Weakness
CWE-326 · Inadequate Encryption Strength
Published
2024-11-22T14:36Z
EPSS history
Timeline
  • 22 NOV 14:36Z
    Apache Answer: Predictable Authorization Token Using UUIDv1
    cvelistv5