PT-2018-11453 · Apache · Apache Fineract

Published 2018-04-20 · Updated 2018-05-22 · CVE-2018-1289

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Fineract versions 0.4.0-incubating through 1.0.0

Description The system exposes different REST endpoints to query domain-specific entities with query parameters orderBy and sortOrder that are directly appended to SQL statements. This allows a hacker or user to inject or draft the orderBy and sortOrder query parameters to read or update data for which they do not have authorization.

Recommendations For Apache Fineract versions 0.4.0-incubating through 1.0.0, consider restricting access to the REST endpoints that utilize the orderBy and sortOrder query parameters until a patch is available. As a temporary workaround, avoid using the orderBy and sortOrder parameters in the affected API endpoints to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-1289

Affected Products

Apache Fineract

References · 4

• https://osv.dev/vulnerability/CVE-2018-1289 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1289 · Security Note
• https://lists.apache.org/thread.html/4a1312b18ed2979fba9e2df07839e6a940eeeea12ed9154db1a49a5a%40%3Cdev.fineract.apache.org%3E · Note
• http://securityfocus.com/bid/104005 · Note