7.5

CVE-2018-20243

Exploit
The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues 726 and 629.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Fineract Version >= 1.0.0 <= 1.3.0
Apache ≫ Fineract Version0.4.0 Updateincubating
Apache ≫ Fineract Version0.5.0 Updateincubating
Apache ≫ Fineract Version0.6.0 Updateincubating
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.68% 0.694
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.