{"id":"CVE-2023-25195","state":"PUBLISHED","title":"Apache Fineract: SSRF template type vulnerability in certain authenticated users","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract.\nAuthorized users with limited permissions can gain access to server and may be able to use server for any outbound traffic. \n\nThis issue affects Apache Fineract: from 1.4 through 1.8.3.\n\n","publishedAt":"2023-03-28T11:16:28.304Z","updatedAt":"2024-10-23T15:16:08.717Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache Fineract"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Fineract","defaultStatus":"affected","versions":[{"version":"1.4","status":"affected","lessThanOrEqual":"1.8.3","versionType":"semver"}]}],"references":["https://lists.apache.org/thread/m58fdjmtkfp9h4c0r4l48rv995w3qhb6"],"weaknesses":["CWE-918"],"ingestedAt":"2026-10-29T20:05:43.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/25xxx/CVE-2023-25195.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-25195","state":"PUBLISHED","datePublished":"2023-03-28T11:16:28.304Z","dateUpdated":"2024-10-23T15:16:08.717Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2023-02-06T01:32:05.395Z"},"containers":{"cna":{"title":"Apache Fineract: SSRF template type vulnerability in certain authenticated users","descriptions":[{"lang":"en","value":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract.\nAuthorized users with limited permissions can gain access to server and may be able to use server for any outbound traffic. \n\nThis issue affects Apache Fineract: from 1.4 through 1.8.3.\n\n"}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Fineract","defaultStatus":"affected","versions":[{"version":"1.4","status":"affected","lessThanOrEqual":"1.8.3","versionType":"semver"}]}],"references":[{"url":"https://lists.apache.org/thread/m58fdjmtkfp9h4c0r4l48rv995w3qhb6","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"moderate"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"CWE-918 Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2023-03-28T11:16:28.304Z"},"credits":[{"lang":"en","type":"reporter","value":"Huydoppa from GHTK "},{"lang":"en","type":"remediation developer","value":"Aleksander"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/m58fdjmtkfp9h4c0r4l48rv995w3qhb6","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T11:18:36.247Z"}},{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"apache","product":"fineract","defaultStatus":"unknown","versions":[{"version":"1.4.0","status":"affected","lessThanOrEqual":"1.8.3","versionType":"custom"}],"cpes":["cpe:2.3:a:apache:fineract:*:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-10-23T15:15:05.674623Z","id":"CVE-2023-25195","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-23T15:16:08.717Z"}}]}}}