“Apache Fineract versions 1.9 and before have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API endpoints’ query parameter”, read the advisory. The vulnerability resides in several REST API endpoints, such as those handling “offices” and “dashboards.” An authenticated attacker can exploit this flaw by injecting malicious SQL code into the query parameters of these API endpoints. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Download the latest version (1.10.1) from the official Apache Fineract website, follow the upgrade instructions provided in the documentation, and verify that all custom extensions or integrations are compatible with the updated version. The vulnerability in Apache Fineract stems from improper input validation and the lack of parameterized queries in its API implementation. Organizations using affected versions should prioritize upgrading to version 1.10.1 without delay to ensure their systems remain secure against this critical threat. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. A successful attack exploiting this vulnerability could have severe consequences, including financial loss, reputational damage, and regulatory penalties. The vulnerability was discovered by Kabilan S, a security engineer at Zoho, and remediated by Aleksandar Vidakovic.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 14 Feb 2025 13:30:15 +0000