DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
This page lists all security vulnerabilities fixed in released version of Apache Fineract. Each vulnerability is given a security impact rating by the Apache security team - please note that this rating may vary from platform to platform.
| Fixed in Apache Fineract 1.4.0 |
|---|
CVE-2018-20243 : Unencrypted username and password
Critical: The implementation of POST with the username and password in the URL parameters exposed the credentials.
Release branch: The fix is available at https://github.com/apache/fineract/tree/1.4.0.
Acknowledgements: We would like to thank Abiy Atsbha <abiyats@gmail.com> for reporting this issue, and the Apache Security team for their assistance.
| Reported to security team | 31 December 2018 |
| Fixed | January 2020 |
| Update Released | 18 September 2020 |
| Issue public | 07 October 2020 |
| Affects | 0.4.0-incubating, 0.5.0-incubating, 0.6.0-incubating, 1.0.0, 1.1.0, 1.2.0, 1.3.0 |
Additional information see: https://issues.apache.org/jira/browse/FINERACT-726 and https://issues.apache.org/jira/browse/FINERACT-629. Note that Client implementations (front-end UIs) should note this change, and instances in-production should always implement safe techniques for transmission of security credentials.
| Fixed in Apache Fineract 1.3.0 |
|---|
CVE-2016-4977 : Remote code execution vulnerabilities as a result of CVE in an upstream dependency
...