CVE-2024-23538
Assigner: apache
Published: 2024-03-29T14:37:40.374Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache Fineract
vendor: Apache Software Foundation
versions: lessThan: 1.8.5
status: affected
version: 0
versionType: semver
credits: type: reporter
value: Yash Sancheti
type: reporter
value: Majd Alasfar of ProgressSoft
descriptions: supportingMedia: base64: no
type: text/html
value: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.<p>This issue affects Apache Fineract: &lt;1.8.5.</p><p>Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue.</p>
value: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5.

Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue.


metrics: other: content: text: important
type: Textual description of severity
cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
type: CWE
source: discovery: UNKNOWN
title: Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.
x_generator: engine: Vulnogram 0.1.0-dev