CVE-2017-5663

CVE-2017-5663: vulnerability in Apache Fineract

Published · Updated

Follow this CVE+ Monitor Apache Fineract

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.1%
In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious SQL into SELECT queries. The 'sqlSearch' parameter on a number of endpoints is not sanitized and appended directly to the query.
Affected products
Apache Software Foundation · Apache Fineract
Related CVEs — Apache Fineract

In the same product, most dangerous first.

CVE-2022-44635HIGHApache Fineract allowed an authenticated user to perform remote code execution due to path traversalEPSS 68.8%CVE-2020-17514—disabled hostname verificiationEPSS 3.4%CVE-2026-35152HIGHApache Fineract: SQL injection in runreports endpointEPSS 3.3%CVE-2018-1290—CVE-2018-1290EPSS 3.2%CVE-2018-1289—CVE-2018-1289EPSS 2.5%CVE-2018-1292—CVE-2018-1292EPSS 2.0%