Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: minor changes to title and description of CVE-2018-20243, as per "Final step on CVE-2018-20243 ready?" email thread

This page lists all security vulnerabilities fixed in released version of Apache Fineract. Each vulnerability is given a security impact rating by the Apache security team - please note that this rating may vary from platform to platform.


Fixed in Apache Fineract 1.4.0


CVE-2018-20243 : Unencrypted username and password password in URL

Critical:  The implementation of POST with the username and   Passing the password in the URL parameters exposed the credentials.  a URL parameter, instead of POST body, risked exposing this credential e.g. in log files and HTTP intermediaries like proxies.  

Release branch: The fix is available at https://github.com/apache/fineract/tree/1.4.0

Acknowledgements: We would like to thank Abiy Atsbha <abiyats@gmail.comfor reporting this issue, and the Apache Security team for their assistance. 

Reported to security team31 December 2018
FixedJanuary 2020
Update Released18 September  2020
Issue public07 October 2020
Affects0.4.0-incubating, 0.5.0-incubating, 0.6.0-incubating, 1.0.0, 1.1.0, 1.2.0, 1.3.0

Additional information see:  https://issues.apache.org/jira/browse/FINERACT-726 and https://issues.apache.org/jira/browse/FINERACT-629. Note that Client implementations (front-end UIs) should note this change, and instances in-production should always implement safe techniques for transmission of security credentials. 

...