CVE-2024-32838: Apache Fineract: SQL injection vulnerabilities in offices API endpoint
SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API endpoints' query parameter. Users are recommended to upgrade to version 1.10.1, which fixes this issue.
A SQL Validator has been implemented which allows us to configure a series of tests and checks against our SQL queries that will allow us to validate and protect against nearly all potential SQL injection attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Fineractto a version that resolves this vulnerability.Fixed in 1.10.1Patch CVE-2024-32838
Event History
Frequently Asked Questions
What is the severity of CVE-2024-32838?
CVE-2024-32838 is classified as a high severity SQL Injection vulnerability.
How do I fix CVE-2024-32838?
To mitigate CVE-2024-32838, upgrade Apache Fineract to version 1.9 or later.
What kind of attack does CVE-2024-32838 allow?
CVE-2024-32838 allows authenticated attackers to inject malicious SQL data into API endpoints.
Which versions of Apache Fineract are affected by CVE-2024-32838?
Apache Fineract versions up to and including 1.9 are affected by CVE-2024-32838.
What are the potential impacts of CVE-2024-32838?
The potential impacts of CVE-2024-32838 include data exposure, data manipulation, or unauthorized access.