CVE-2017-5663: falha em Apache Fineract
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 2.1%
In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious SQL into SELECT queries. The 'sqlSearch' parameter on a number of endpoints is not sanitized and appended directly to the query.
Produtos afetados
Apache Software Foundation · Apache FineractCVEs relacionadas — Apache Fineract
No mesmo produto, das mais perigosas para as menos.
CVE-2022-44635HIGHApache Fineract allowed an authenticated user to perform remote code execution due to path traversalEPSS 68.8%CVE-2020-17514—disabled hostname verificiationEPSS 3.4%CVE-2026-35152HIGHApache Fineract: SQL injection in runreports endpointEPSS 3.3%CVE-2018-1290—CVE-2018-1290EPSS 3.2%CVE-2018-1289—CVE-2018-1289EPSS 2.5%CVE-2018-1292—CVE-2018-1292EPSS 2.0%