Vulnerability · Published May 27, 2021 · Assigned by apache
CVE-2020-17514disabled hostname verificiation
High 7.4
In plain English
A high-severity security flaw in Apache Fineract from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities).
Severity (CVSS NVD)7.4High
Exploit odds (30 days)3.4%top 11.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Fineract | Apache Fineract – before 1.5.0 |
References
- https://issues.apache.org/jira/browse/FINERACT-1211 x_refsource_MISC
- [fineract-dev] 20210527 Re: Release 1.5.0 fixed security issue CVE-2020-17514 mailing-list, x_refsource_MLIST
- [oss-security] 20210527 CVE-2020-17514: Apache Fineract: Disabled hostname verification for HTTPS mailing-list, x_refsource_MLIST