DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
This page lists all security vulnerabilities fixed in released version of Apache Fineract. Each vulnerability is given a security impact rating by the Apache security team - please note that this rating may vary from platform to platform.
| Fixed in Apache Fineract 1.4.0 |
|---|
CVE-2018-20243 : Unencrypted username and password password in URL
Critical: The implementation of POST with the username and Passing the password in the URL parameters exposed the credentials. a URL parameter, instead of POST body, risked exposing this credential e.g. in log files and HTTP intermediaries like proxies.
Release branch: The fix is available at https://github.com/apache/fineract/tree/1.4.0.
Acknowledgements: We would like to thank Abiy Atsbha <abiyats@gmail.com> for reporting this issue, and the Apache Security team for their assistance.
| Reported to security team | 31 December 2018 |
| Fixed | January 2020 |
| Update Released | 18 September 2020 |
| Issue public | 07 October 2020 |
| Affects | 0.4.0-incubating, 0.5.0-incubating, 0.6.0-incubating, 1.0.0, 1.1.0, 1.2.0, 1.3.0 |
Additional information see: https://issues.apache.org/jira/browse/FINERACT-726 and https://issues.apache.org/jira/browse/FINERACT-629. Note that Client implementations (front-end UIs) should note this change, and instances in-production should always implement safe techniques for transmission of security credentials.
...