Description
Missing Authorization vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Answer | ≤ 2.0.2 | — |
References
- https://lists.apache.org/thread/msodd7g2r6xdn9wpkpdp04m9g1jb2xtl vendor-advisory