CVE-2024-32838

HIGH

Apache Fineract 1.4.0-1.9 - Authenticated SQL Injection via REST API Query Parameters

Title source: llm

Description

SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API endpoints' query parameter. Users are recommended to upgrade to version 1.10.1, which fixes this issue. A SQL Validator has been implemented which allows us to configure a series of tests and checks against our SQL queries that will allow us to validate and protect against nearly all potential SQL injection attacks.

References (2)

Core 2

Core References

Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2025/02/12/1

Mailing List, Vendor Advisory vendor-advisory

https://lists.apache.org/thread/7l88h17pn9nf8zpx5bbojk7ko5oxo1dy

Scores

CVSS v3 8.8

EPSS 0.0015

EPSS Percentile 35.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-89

Status published

Products (1)

apache/fineract 1.4.0 - 1.10.1

Published Feb 12, 2025

Tracked Since Feb 18, 2026