CVE-2022-44635

Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code. This issue affects Apache Fineract version 1.8.0 and prior versions. We recommend users to upgrade to 1.8.1.

Score

CVSS 3.1 8.8 High

Status

Modified - security@apache.org

Published

2022-11-29

Last modified

2025-04-25

Weaknesses

CWE-22

Affected products

• Fineract (Apache)
• Apache Fineract (Apache Software Foundation)

References

• http://www.openwall.com/lists/oss-security/2022/11/29/3
• https://lists.apache.org/thread/t8q6fmh3o6yqmy69qtqxppk9yg9wfybg