Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: CVE-2018-20243 added

This page lists all security vulnerabilities fixed in released version of Apache Fineract. Each vulnerability is given a security impact rating by the Apache security team - please note that this rating may vary from platform to platform.


Fixed in Apache Fineract 1.4.0


CVE-2018-20243 : Unencrypted username and password 

Critical:  The implementation of POST with the username and password in the URL parameters exposed the credentials.  

Release branch: The fix is available at https://github.com/apache/fineract/tree/1.4.0

Acknowledgements: We would like to thank Abiy Atsbha <abiyats@gmail.comfor reporting this issue, and the Apache Security team for their assistance. 

Reported to security team31 December 2018
FixedJanuary 2020
Update Released18 September  2020
Issue public07 October 2020
Affects0.4.0-incubating, 0.5.0-incubating, 0.6.0-incubating, 1.0.0, 1.1.0, 1.2.0, 1.3.0

Additional information see:  https://issues.apache.org/jira/browse/FINERACT-726 and https://issues.apache.org/jira/browse/FINERACT-629. Note that Client implementations (front-end UIs) should note this change, and instances in-production should always implement safe techniques for transmission of security credentials. 


Fixed in Apache Fineract 1.3.0

CVE-2016-4977 : Remote code execution vulnerabilities as a result of CVE in an upstream dependency

...