Apache: >> Fineract >> 1.1.0 Security Vulnerabilities
Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful.
CVSS Score
7.4
EPSS Score
0.034
Published
2021-05-27
The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues 726 and 629.
CVSS Score
7.5
EPSS Score
0.027
Published
2020-10-13
SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on the GroupSummaryCounts related table.
CVSS Score
9.8
EPSS Score
0.052
Published
2019-06-11
SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on a m_center data related table.
CVSS Score
9.8
EPSS Score
0.052
Published
2019-06-11
Page 2