CVE-2024-23539
Assigner: apache
Published: 2024-03-29T14:36:57.919Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache Fineract
vendor: Apache Software Foundation
versions: lessThanOrEqual: 1.8.4
status: affected
version: 0
versionType: custom
credits: type: finder
value: Yash Sancheti of GH Solutions Consultants
descriptions: supportingMedia: base64: no
type: text/html
value: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.<p>This issue affects Apache Fineract: &lt;1.8.5.</p><p>Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue.</p>
value: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5.

Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue.


metrics: other: content: text: critical
type: Textual description of severity
cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
type: CWE
source: discovery: UNKNOWN
title: Apache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries. 
x_generator: engine: Vulnogram 0.1.0-dev