PT-2025-50904 · Apache · Apache Fineract

Kristof Jozsa + 1 · Published 2025-12-12 · Updated 2025-12-18 · CVE-2025-23408

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Apache Fineract versions through 1.10.1

Description Apache Fineract is affected by a weak password requirements issue. Upgrade to version 1.11.0 or later to address this. Users are encouraged to upgrade to version 1.13.0, the latest release.

Recommendations Upgrade to version 1.11.0 or later. Upgrade to version 1.13.0.

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2025-23408

Affected Products

Apache Fineract

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-23408 · Security Note
• https://lists.apache.org/thread/bdlb6wl968yh1n48mr5npsk2spo6dncf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-23408 · Vendor Advisory
• https://twitter.com/oss_security/status/1999285020025045302 · Twitter Post
• https://t.me/CVEtracker/39607 · Telegram Post
• http://openwall.com/lists/oss-security/2025/12/11/5 · Note
• https://t.me/cveNotify/145577 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1999442338230174080 · Twitter Post
• https://t.me/cveNotify/146200 · Telegram Post