Apache Answer Unrestricted File Upload Vulnerability Allowing Dangerous Types

A vulnerability allowing unrestricted upload of files with dangerous types has been identified in Apache Answer versions through 2.0.0. The issue arises because the server failed to properly validate user-supplied image URLs. This lack of validation allows arbitrary external content to be embedded as profile images, potentially exposing users to unintended external requests and tracking by third-party servers.

Impact

Exploitation of this vulnerability could lead to unauthorized external content being embedded in user profiles, allowing for tracking and unintended interactions with third-party servers.

Remediation

Users are advised to upgrade to Apache Answer version 2.0.1 or later, which addresses this vulnerability.