CVE-2024-45719
Apache Answer: Predictable Authorization Token Using UUIDv1
Inadequate Encryption Strength vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.4.0.
The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Answer: Predictable Authorization Token Using UUIDv1
Inadequate Encryption Strength vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.4.0.
The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1, which fixes the issue.
- Record
CVE-2024-45719- CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
EUVDEUVD-2024-3370
Inadequate Encryption Strength vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.4.0.
The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1, which fixes the issue.
- Record
EUVD-2024-3370- CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mr95-vfcf-fx9p
Apache Answer: Predictable Authorization Token Using UUIDv1
Inadequate Encryption Strength vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.4.0.
The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1, which fixes the issue.
- Record
GHSA-mr95-vfcf-fx9p- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N - CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
NVD
Inadequate Encryption Strength vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.4.0.
The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1, which fixes the issue.
- Record
CVE-2024-45719- CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
OSV
Apache Answer: Predictable Authorization Token Using UUIDv1
Inadequate Encryption Strength vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.4.0.
The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1, which fixes the issue.
- Record
CVE-2024-45719- CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
OSVGHSA-mr95-vfcf-fx9p
Apache Answer: Predictable Authorization Token Using UUIDv1
Inadequate Encryption Strength vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.4.0.
The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1, which fixes the issue.
- Record
GHSA-mr95-vfcf-fx9p- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N - CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
OSVGO-2024-3287 No score
Apache Answer: Predictable Authorization Token Using UUIDv1 in github.com/apache/incubator-answer
Apache Answer: Predictable Authorization Token Using UUIDv1 in github.com/apache/incubator-answer
- Record
GO-2024-3287- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14567-1 No score
govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20241209T183251-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14567-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/apache/incubator-answerGo |
before 1.4.1 | 1.4.1 |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 21 CVEs |
before 0.0.20241209T183251-1.1 | 0.0.20241209T183251-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-45719 is a low vulnerability (CVSS 2.6) in Apache Answer, published November 22, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 18th percentile. Fixed in github.com/apache/incubator-answer 1.4.1.
References
lists.apache.org/thread/sz2d0z39k01nbx3r9pj65t76o1hy9491
openwall.com/lists/oss-security/2024/11/22/1
nvd.nist.gov/vuln/detail/CVE-2024-45719
github.com/advisories/GHSA-mr95-vfcf-fx9p
Show 22 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU
suse.com/security/cve/CVE-2024-10220