PT-2018-11453 · Apache · Apache Fineract

Publicado 2018-04-20 · Atualizado 2018-05-22 · CVE-2018-1289

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Fineract versions 0.4.0-incubating through 1.0.0

Description The system exposes different REST endpoints to query domain-specific entities with query parameters orderBy and sortOrder that are directly appended to SQL statements. This allows a hacker or user to inject or draft the orderBy and sortOrder query parameters to read or update data for which they do not have authorization.

Recommendations For Apache Fineract versions 0.4.0-incubating through 1.0.0, consider restricting access to the REST endpoints that utilize the orderBy and sortOrder query parameters until a patch is available. As a temporary workaround, avoid using the orderBy and sortOrder parameters in the affected API endpoints to minimize the risk of exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-1289

Produtos afetados

Apache Fineract

Referências · 4

• https://lists.apache.org/thread.html/4a1312b18ed2979fba9e2df07839e6a940eeeea12ed9154db1a49a5a%40%3Cdev.fineract.apache.org%3E · Nota
• http://securityfocus.com/bid/104005 · Nota
• https://osv.dev/vulnerability/CVE-2018-1289 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1289 · Nota de Segurança