Apache Fineract Insufficiently Protected Credentials

Apache Fineract is a Java-based open-source software for financial institutions and other organizations. It provides a platform for managing financial data, transactions, and compliance. The vulnerability in Apache Fineract allows attackers to bypass authentication mechanisms, potentially leading to unauthorized access to sensitive financial information.

You're affected if you use Insufficiently Protected Credentials vulnerability. Affected versions: 1.11.0

To fix the issue, upgrade to Apache Fineract version 1.12.1 or later. You can download the latest release from the Apache Software Foundation's website: https://fineract.apache.org/downloads.html

Immediate mitigations:

• Restrict network access to your Fineract instance (firewall it from the public internet)
• Audit admin account activity for suspicious access patterns
• Monitor for unauthorized token creation

• lists.apache.org
• www.openwall.com