VULNERABILITY INTELLIGENCE

CVE-2018-20243

CVSS score7.5 HIGH

EPSS probability2.67%

CISA KEVNot currently listed

Published2020-10-13

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues 726 and 629.

Weakness classification

CWE-522: Insufficiently Protected Credentials

Primary references

security@apache.org — Exploit, Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mailing List, Patch, Third Party Advisory