CVE-2024-32838 Apache Fineract: SQL injection vulnerabilities in offices API endpoint
An authenticated attacker can inject malicious SQL into Fineract API endpoints, potentially reading or modifying sensitive financial data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-32838?
CVE-2024-32838 is a critical SQL injection vulnerability in Apache Fineract, published on 12 Feb 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API endpoints' query parameter. Users are recommended to upgrade to version 1.10.1, which fixes this issue.
A SQL Validator has been implemented which allows us to configure a series of tests and checks against our SQL queries that will allow us to validate and protect against nearly all potential SQL injection attacks.
Weakness: CWE-89
Which versions are affected by CVE-2024-32838?
It affects 1 product.
Products include Apache Fineract.
How do I fix CVE-2024-32838?
No fix has been published for CVE-2024-32838 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-32838 being exploited?
There is no known exploitation of CVE-2024-32838 in the wild and no public exploit code.
Other vulnerabilities in Apache Fineract
Sources
Also known as GHSA-pqv7-crpv-669v.