CVE-2024-32838

CWE-89 — SQL Injection3 documents3 sources

Severity

9.4CRITICAL

EPSS

0.1%

top 64.38%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Fineract Apache Software Foundation Apache Fineract

Timeline

PublishedFeb 12

Description

SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API endpoints' query parameter. Users are recommended to upgrade to version 1.10.1, which fixes this issue. A SQL Validator has been implemented which allows us to configure a series of tests and checks against our SQL queries that will allow us to validate and protect ag…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Affected Packages2 packages

▶NVDapache/fineract1.4.0 — 1.10.1

▶CVEListV5apache_software_foundation/apache_fineract1.4 — 1.9

🔴Vulnerability Details

GHSA

GHSA-pqv7-crpv-669v: SQL Injection vulnerability in various API endpoints - offices, dashboards, etc↗2025-02-12

▶

CVEList

Apache Fineract: SQL injection vulnerabilities in offices API endpoint↗2025-02-12

▶