CVE-2020-17514

disabled hostname verificiation

State: Published
Severity: Not scored
Published: May 27, 2021
Updated: Aug 4, 2024
Reserved: Aug 12, 2020

Description

Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Apache FineractApache Software Foundation	Apache Fineract to before 1.5.0Affected

References

https://issues.apache.org/jira/browse/FINERACT-1211
[fineract-dev] 20210527 Re: Release 1.5.0 fixed security issue CVE-2020-17514mailing-list
[oss-security] 20210527 CVE-2020-17514: Apache Fineract: Disabled hostname verification for HTTPSmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.