Apache: >> Fineract >> 0.5.0-incubating Security Vulnerabilities
Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful.
CVSS Score
7.4
EPSS Score
0.034
Published
2021-05-27
SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on the GroupSummaryCounts related table.
CVSS Score
9.8
EPSS Score
0.052
Published
2019-06-11
SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on a m_center data related table.
CVSS Score
9.8
EPSS Score
0.052
Published
2019-06-11
In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious SQL into SELECT queries. The 'sqlSearch' parameter on a number of endpoints is not sanitized and appended directly to the query.
CVSS Score
8.8
EPSS Score
0.021
Published
2017-12-14
Page 2