CVE-2024-32838: Apache Fineract: SQL injection vulnerabilities in offices API endpoint
First published: Wed Feb 12 2025(Updated: )
SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API endpoints' query parameter. Users are recommended to upgrade to version 1.10.1, which fixes this issue. A SQL Validator has been implemented which allows us to configure a series of tests and checks against our SQL queries that will allow us to validate and protect against nearly all potential SQL injection attacks.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Fineract | <1.9 | |
| >=1.4.0<1.10.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-32838?
CVE-2024-32838 is classified as a high severity SQL Injection vulnerability.
How do I fix CVE-2024-32838?
To mitigate CVE-2024-32838, upgrade Apache Fineract to version 1.9 or later.
What kind of attack does CVE-2024-32838 allow?
CVE-2024-32838 allows authenticated attackers to inject malicious SQL data into API endpoints.
Which versions of Apache Fineract are affected by CVE-2024-32838?
Apache Fineract versions up to and including 1.9 are affected by CVE-2024-32838.
What are the potential impacts of CVE-2024-32838?
The potential impacts of CVE-2024-32838 include data exposure, data manipulation, or unauthorized access.
- agent/title
- agent/weakness
- agent/description
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-32838
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/trending
- agent/last-modified-date
- agent/references
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- vendor/apache
- canonical/apache fineract
- version/apache fineract/1.4.0