PT-2018-11477 · Apache · Apache Fineract

圆珠笔 · Publicado 2018-04-20 · Atualizado 2018-05-22 · CVE-2018-1292

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Fineract versions 0.4.0-incubating through 1.0.0

Description The issue allows a hacker to inject SQL, enabling them to read or update data without proper authorization. This is achieved by exploiting the reportName parameter within the getReportType method.

Recommendations For Apache Fineract versions 0.4.0-incubating through 1.0.0, as a temporary workaround, consider restricting access to the getReportType method until a patch is available. Avoid using the reportName parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-1292

Produtos afetados

Apache Fineract

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-1292 · Nota de Segurança
• http://securityfocus.com/bid/104007 · Nota
• https://lists.apache.org/thread.html/a24610817845d022d5fe89cfe21563ef83bea35ca95de867cd2c4ee9%40%3Cdev.fineract.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2018-1292 · Aviso do Fabricante