CVE-2022-44635

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-44635

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-44635.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-44635

Published

2022-11-29T00:00:00Z

Modified

2026-07-15T02:07:03.053773359Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache Fineract allowed an authenticated user to perform remote code execution due to path traversal

Details

Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code. This issue affects Apache Fineract version 1.8.0 and prior versions. We recommend users to upgrade to 1.8.1.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/44xxx/CVE-2022-44635.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "Apache Fineract 1.8"
                },
                {
                    "last_affected": "1.8.0"
                },
                {
                    "introduced": "Apache Fineract 1.7"
                },
                {
                    "last_affected": "1.7.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "apache"
}

References

Affected packages

Git / github.com/apache/fineract

Affected ranges

Type

GIT

Repo

https://github.com/apache/fineract

Events

Introduced

Fixed

90f854b68886458a466b048807c26ccf31a6f555

Database specific

{
    "cpe": "cpe:2.3:a:apache:fineract:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.8.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

1.*

1.0.0

1.1.0

1.2.0

1.3.0

1.5.0

1.8.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-44635.json"