« Volver al listado

CVE-2018-1289

Estado: ModificadaAlta (8.8)—

In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy' and 'sortOrder' which are appended directly with SQL statements. A hacker/user can inject/draft the 'orderBy' and 'sortOrder' query parameter in such a way to read/update the data for which he doesn't have authorization.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Fineract

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-1289",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Fineract",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0"
            },
            {
              "status": "affected",
              "version": "0.6.0-incubating"
            },
            {
              "status": "affected",
              "version": "0.5.0-incubating"
            },
            {
              "status": "affected",
              "version": "0.4.0-incubating"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-04-20T18:29:00.567",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/104005",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/4a1312b18ed2979fba9e2df07839e6a940eeeea12ed9154db1a49a5a%40%3Cdev.fineract.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/104005",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/4a1312b18ed2979fba9e2df07839e6a940eeeea12ed9154db1a49a5a%40%3Cdev.fineract.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy' and 'sortOrder' which are appended directly with SQL statements. A hacker/user can inject/draft the 'orderBy' and 'sortOrder' query parameter in such a way to read/update the data for which he doesn't have authorization."
    },
    {
      "lang": "es",
      "value": "En Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating y 0.4.0-incubating, el sistema expone diferentes endpoints REST para consultar entidades específicas del dominio con los parámetros de consulta 'orderBy' y 'sortOrder', que se anexan directamente con instrucciones SQL. Un hacker/usuario puede inyectar/esbozar los parámetros de consulta 'orderBy' y 'sortOrder' de tal forma que pueda leer/actualizar los datos para los que no tiene autorización."
    }
  ],
  "lastModified": "2026-06-17T01:50:55.910",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:fineract:0.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11BD53DC-BF35-4D6B-8EE3-23DA64A37DAD"
            },
            {
              "criteria": "cpe:2.3:a:apache:fineract:0.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E138AC79-D9EA-453E-871D-D3E9ED648680"
            },
            {
              "criteria": "cpe:2.3:a:apache:fineract:0.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A44C7D22-94B0-41EF-ADC0-5B9AE474CDDE"
            },
            {
              "criteria": "cpe:2.3:a:apache:fineract:1.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28EFC774-5327-4456-9D1C-DABB24CB2BC5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}