CVE-2020-17514

HIGH

Apache Fineract <1.5.0 - Info Disclosure

Title source: llm

Description

Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful.

References (3)

Scores

CVSS v3 7.4
EPSS 0.0081
EPSS Percentile 74.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Classification

Status published

Affected Products (1)

apache/fineract < 1.5.0

Timeline

Published May 27, 2021
Tracked Since Feb 18, 2026