GHSA-8jg3-rx43-3fv4

ghsaUSosv

Answer vulnerable to Exposure of Sensitive Information Through Metadata

view advisory published 2023-04-11Licence: CC-BY-4.0

answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.8 may expose sensitive information, such as EXIF data and GPS coordatinates, via image metadata.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-1974US	medium6.5	0.60% (48th)	—	2023-04-11
Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8.

references

External citations — patches, advisories, analysis.

https://github.com/answerdev/answerPACKAGE
https://github.com/answerdev/answer/commit/ac3f2f047ee00b4edaea7530e570ab67ff87cd6aWEB
https://huntr.dev/bounties/852781c6-9cc8-4d25-9336-bf3cb8ee3439WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-1974ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan