VulnerabilityModified
CVE-2023-25195
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract.
HIGH 8.1EPSS 0.98%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.98%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract. Authorized users with limited permissions can gain access to server and may be able to use server for any outbound traffic. This issue affects Apache Fineract: from 1.4 through 1.8.3.
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 0.98% probability · 60th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-918
- Affected
- apache/fineract
- Source
- security@apache.org
References
- https://lists.apache.org/thread/m58fdjmtkfp9h4c0r4l48rv995w3qhb6Mailing List, Vendor Advisory
- https://lists.apache.org/thread/m58fdjmtkfp9h4c0r4l48rv995w3qhb6Mailing List, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.