Vulnerability in Apache Answer
CVE-2025-29868
Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of that accessing user. Users are recommended to upgrade to version 1.4.5, which fixes the issue. In the new version, administrators can set whether external content can be displayed.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.010 (62.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 62nd percentile — 62.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: +0.000
Affected products
- Apache Answer
- Apache Software Foundation Answer — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread/l7pohw5g03g3qsvrz8pqc9t29mdv5lhf (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
Frequently asked questions
- What is CVE-2025-29868?
- CVE-2025-29868 is a medium-severity vulnerability in Apache Answer, classified under CWE-495. CVSS score: 6.5/10. Published 2025-04-01.
- How severe is CVE-2025-29868?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2025-29868 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.