{"id":"CVE-2024-45719","aliases":["EUVD-2024-3370","GHSA-mr95-vfcf-fx9p","GO-2024-3287","openSUSE-SU-2024:14567-1"],"status":"published","title":"Apache Answer: Predictable Authorization Token Using UUIDv1","description":"Inadequate Encryption Strength vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.4.0.\n\nThe ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable.\nUsers are recommended to upgrade to version 1.4.1, which fixes the issue.","severity":{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00263,"percentile":0.18338,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-326"],"published":"2024-11-22T14:36:44Z","modified":"2026-10-28T02:30:58Z","fixes":[{"ecosystem":"Go","package":"github.com/apache/incubator-answer","fixed_in":["1.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/apache/incubator-answer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/apache/incubator-answer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/apache/incubator-answer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241209T183251-1.1"}]}],"bundled":21}],"products":[{"vendor":"apache","product":"answer"},{"vendor":"apache software foundation","product":"apache answer"}],"references":[{"url":"https://lists.apache.org/thread/sz2d0z39k01nbx3r9pj65t76o1hy9491","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/11/22/1","tags":["Mailing List","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45719","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mr95-vfcf-fx9p","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45719.json","tags":["advisory"]},{"url":"https://github.com/apache/incubator-answer","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8676","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-45719","title":"Apache Answer: Predictable Authorization Token Using UUIDv1","description":"Inadequate Encryption Strength vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.4.0.\n\nThe ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable.\nUsers are recommended to upgrade to version 1.4.1, which fixes the issue.","status":"published","published":"2024-11-22T14:36:44.588Z","modified":"2024-11-22T20:18:15.264Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:34:08.16279Z"}],"euvd":[{"id":"EUVD-2024-3370","description":"Inadequate Encryption Strength vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.4.0.\n\nThe ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable.\nUsers are recommended to upgrade to version 1.4.1, which fixes the issue.","status":"published","published":"2024-11-22T14:36:44Z","modified":"2024-11-22T20:18:15Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T00:04:50.128137Z"}],"ghsa":[{"id":"GHSA-mr95-vfcf-fx9p","title":"Apache Answer: Predictable Authorization Token Using UUIDv1","description":"Inadequate Encryption Strength vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.4.0.\n\nThe ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable.\nUsers are recommended to upgrade to version 1.4.1, which fixes the issue.","status":"published","published":"2024-11-22T21:32:14Z","modified":"2024-11-27T21:56:48Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","level":"low"},{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:38:24.542211Z"}],"nvd":[{"id":"CVE-2024-45719","description":"Inadequate Encryption Strength vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.4.0.\n\nThe ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable.\nUsers are recommended to upgrade to version 1.4.1, which fixes the issue.","status":"published","published":"2024-11-22T15:15:10.473Z","modified":"2026-06-17T07:54:42.22Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:10:37.996328Z"}],"osv":[{"id":"CVE-2024-45719","title":"Apache Answer: Predictable Authorization Token Using UUIDv1","description":"Inadequate Encryption Strength vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.4.0.\n\nThe ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable.\nUsers are recommended to upgrade to version 1.4.1, which fixes the issue.","status":"published","published":"2024-11-22T14:36:44.588Z","modified":"2026-10-28T02:30:58.355097483Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T15:44:42.790566Z"},{"id":"GHSA-mr95-vfcf-fx9p","title":"Apache Answer: Predictable Authorization Token Using UUIDv1","description":"Inadequate Encryption Strength vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.4.0.\n\nThe ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable.\nUsers are recommended to upgrade to version 1.4.1, which fixes the issue.","status":"published","published":"2024-11-22T21:32:14Z","modified":"2024-11-27T21:56:44Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low"},{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","level":"low"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"GO-2024-3287","title":"Apache Answer: Predictable Authorization Token Using UUIDv1 in github.com/apache/incubator-answer","description":"Apache Answer: Predictable Authorization Token Using UUIDv1 in github.com/apache/incubator-answer","status":"published","published":"2024-11-27T19:16:39Z","modified":"2026-03-03T04:56:03.637929Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"openSUSE-SU-2024:14567-1","title":"govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20241209T183251-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-11T00:00:00Z","modified":"2026-02-04T02:48:53.761072Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}