CVE-2024-23538 — Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks…

CVE-2024-23538

Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries. PUBLISHED

Description (CNA)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Fineract	affected 0 before 1.8.5

CWE

CWE-89

References

https://cwiki.apache.org/confluence/display/FINERACT/Apache+Fineract+Security+Report
https://lists.apache.org/thread/by32w2dylzgbqm5940x3wj7519wolqxs
http://www.openwall.com/lists/oss-security/2024/03/29/2

ADP enrichment

CVE

No English description supplied.

https://cwiki.apache.org/confluence/display/FINERACT/Apache+Fineract+Security+Report
https://lists.apache.org/thread/by32w2dylzgbqm5940x3wj7519wolqxs
http://www.openwall.com/lists/oss-security/2024/03/29/2

CISA-ADP

No English description supplied.

No references supplied.