PT-2025-6469 · Apache · Apache Fineract

Aleksandar Vidakovic + 1 · Published 2025-02-12 · Updated 2025-02-24 · CVE-2024-32838

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Apache Fineract versions 1.9 and earlier

Description A SQL injection vulnerability exists in various API endpoints, including offices and dashboards, which allows an authenticated attacker to inject malicious data into some of the query parameters of the REST API endpoints. This issue is resolved in version 1.10.1, which includes a SQL Validator to configure tests and checks against SQL queries, protecting against potential SQL injection attacks.

Recommendations For Apache Fineract versions 1.9 and earlier, upgrade to version 1.10.1 to fix the SQL injection vulnerability. As a temporary workaround, consider restricting access to the vulnerable API endpoints until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-03827

CVE-2024-32838

Affected Products

Apache Fineract

References · 16

• https://bdu.fstec.ru/vul/2025-03827 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-32838 · Security Note
• https://lists.apache.org/thread/7l88h17pn9nf8zpx5bbojk7ko5oxo1dy · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32838 · Vendor Advisory
• https://twitter.com/the_yellow_fall/status/1890224847063798101 · Twitter Post
• https://twitter.com/oss_security/status/1889697262139265051 · Twitter Post
• https://twitter.com/TheSecMaster1/status/1893908321473597898 · Twitter Post
• https://twitter.com/pravin_karthik/status/1890396659516919886 · Twitter Post
• https://twitter.com/CVEnew/status/1889673486072676710 · Twitter Post
• https://t.me/pentestingnews/56556 · Telegram Post
• https://twitter.com/Brandefense/status/1891740649239769273 · Twitter Post
• http://openwall.com/lists/oss-security/2025/02/12/1 · Note
• https://twitter.com/fridaysecurity/status/1890224915967783295 · Twitter Post
• https://twitter.com/Dinosn/status/1890229893809730025 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1889714034661789990 · Twitter Post