CVE-2018-1289

Name of the Vulnerable Software and Affected Versions Apache Fineract versions 0.4.0-incubating through 1.0.0

Description The system exposes different REST endpoints to query domain-specific entities with query parameters orderBy and sortOrder that are directly appended to SQL statements. This allows a hacker or user to inject or draft the orderBy and sortOrder query parameters to read or update data for which they do not have authorization.

Recommendations For Apache Fineract versions 0.4.0-incubating through 1.0.0, consider restricting access to the REST endpoints that utilize the orderBy and sortOrder query parameters until a patch is available. As a temporary workaround, avoid using the orderBy and sortOrder parameters in the affected API endpoints to minimize the risk of exploitation.