CVE-2025-29868
Apache Answer ≤ 1.4.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-29868 is a medium-severity Private Data Structure Returned From A Public Method (CWE-495) vulnerability in Apache Answer. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 44% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9320
Vulnerability Data
Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain…
more
private information about the ip address of that accessing user. Users are recommended to upgrade to version 1.4.5, which fixes the issue. In the new version, administrators can set whether external content can be displayed.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.3.1
Mitigating Controls (NIST 800-53 r5) AI
Security engineering principles include encapsulation and information hiding that structurally prevent public methods from leaking modifiable private objects.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce proper encapsulation and data-hiding rules that prevent public methods from exposing mutable private structures.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect the weakness but does not itself prevent it at design time.
Secure SDLC practices can mandate encapsulation and return-value design rules that prevent leaking private structures.
Application security requirements can explicitly require defensive-copy or immutable return objects to avoid exposing internal state.
Secure architecture principles such as least privilege and encapsulation directly address the exposure of private data structures.
Secure coding standards can forbid public methods that return references to private mutable structures, largely eliminating this weakness.