CVE-2023-25195

HIGH

Apache Fineract 1.4.0-1.8.3 - Authenticated Server-Side Request Forgery

Title source: llm

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract. Authorized users with limited permissions can gain access to server and may be able to use server for any outbound traffic. This issue affects Apache Fineract: from 1.4 through 1.8.3.

References (1)

Core 1

Core References

Mailing List, Vendor Advisory vendor-advisory

https://lists.apache.org/thread/m58fdjmtkfp9h4c0r4l48rv995w3qhb6

Scores

CVSS v3 8.1

EPSS 0.0016

EPSS Percentile 37.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-918

Status published

Products (1)

apache/fineract 1.4.0 - 1.8.3

Published Mar 28, 2023

Tracked Since Feb 18, 2026