CVE-2023-25195: Apache Fineract: SSRF template type vulnerability in certain authenticated users

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-28 · updated 2026-06-17
Weakness: CWE-918

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract. Authorized users with limited permissions can gain access to server and may be able to use server for any outbound traffic. This issue affects Apache Fineract: from 1.4 through 1.8.3.

Affected products

Apache Software Foundation Apache Fineract: from 1.4.0 through 1.8.3

References

https://lists.apache.org/thread/m58fdjmtkfp9h4c0r4l48rv995w3qhb6
https://lists.apache.org/thread/m58fdjmtkfp9h4c0r4l48rv995w3qhb6

Get alerted when CVE-2023-25195 or the next vulnerability affects your stack