Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Pixel Flood Attack by uploading large pixel files will cause server out of memory. A logged-in user can cause such an attack by uploading an image when posting content. Users are recommended to upgrade to version [1.2.5], which fixes the issue.
The Apache Answer application does not impose adequate restrictions on the type or size of uploaded image files (CWE-434 — Unrestricted Upload of File with Dangerous Type). A logged-in user can upload an image with an extremely large number of pixels when adding content. While processing such a file, the server attempts to allocate a huge amount of operating memory, leading to its exhaustion (so-called Pixel Flood attack). As a result, the server becomes unavailable to other users.
An attacker can exhaust server memory and cause denial of service (DoS) for all platform users. Data integrity may also be compromised through uncontrolled upload of dangerous file types.
Apache Answer should be updated to version 1.2.5 or newer, which contains a patch eliminating the described vulnerability.
Apache Answer in versions up to and including 1.2.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HApache Answer
APPApache< 1.2.5
Related vulnerabilities
Apache Answer: nieważne klucze API nadal aktywne po degradacji konta
Apache Answer: przejęcie konta przez brak weryfikacji w external-login
Apache Answer: nieuprawniony dostęp do usuniętych/oczekujących odpowiedzi
Apache Answer — DoS przez nieprawidłowy nagłówek Accept-Language
Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache A...