PT-2018-11477 · Apache · Apache Fineract

圆珠笔 · Published 2018-04-20 · Updated 2018-05-22 · CVE-2018-1292

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Fineract versions 0.4.0-incubating through 1.0.0

Description The issue allows a hacker to inject SQL, enabling them to read or update data without proper authorization. This is achieved by exploiting the reportName parameter within the getReportType method.

Recommendations For Apache Fineract versions 0.4.0-incubating through 1.0.0, as a temporary workaround, consider restricting access to the getReportType method until a patch is available. Avoid using the reportName parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-1292

Affected Products

Apache Fineract

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-1292 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1292 · Vendor Advisory
• http://securityfocus.com/bid/104007 · Note
• https://lists.apache.org/thread.html/a24610817845d022d5fe89cfe21563ef83bea35ca95de867cd2c4ee9%40%3Cdev.fineract.apache.org%3E · Note