Vulnerability in Apache Answer
CVE-2025-29868
Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of that accessing user. Users are recommended to upgrade to version 1.4.5, which fixes the issue. In the new version, administrators can set whether external content can be displayed.
EPSS: 0.009 (59.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Apache Answer
- Apache Software Foundation Answer — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
Frequently asked questions
- What is CVE-2025-29868?
- CVE-2025-29868 is a medium-severity vulnerability in Apache Answer, classified under CWE-495. CVSS score: 6.5/10. Published 2025-04-01.
- How severe is CVE-2025-29868?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2025-29868 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.