Code injection

Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful...

PT-2021-10093

Name of the Vulnerable Software and Affected Versions: Apache Fineract versions prior to 1.5.0 Description: The issue allows for a man-in-the-middle attack due to the disabling of HTTPS hostname verification in the configureClient method of ProcessorHelper. This could be successful under typical...