PT-2021-10093
CVE-2020-17514
·
Published
2021-05-27
·
Updated
2021-06-07
Description by
CVSS 3.1
7.4
HighMetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions:
Apache Fineract versions prior to 1.5.0
Description:
The issue allows for a man-in-the-middle attack due to the disabling of HTTPS hostname verification in the
configureClient method of ProcessorHelper. This could be successful under typical deployments.Recommendations:
For versions prior to 1.5.0, update to version 1.5.0 or later to enable HTTPS hostname verification and prevent man-in-the-middle attacks.
Found an issue in the description? Have something to add? Feel free to write us 👾