CVE-2022-44635

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code. This issue affects Apache Fineract version 1.8.0 and prior versions. We recommend users to upgrade to 1.8.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Fineract	>= Apache Fineract 1.8, <= 1.8.0; >= Apache Fineract 1.7, <= 1.7.0

References

http://www.openwall.com/lists/oss-security/2022/11/29/3Mailing List, Third Party Advisory
https://lists.apache.org/thread/t8q6fmh3o6yqmy69qtqxppk9yg9wfybgMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/11/29/3Mailing List, Third Party Advisory
https://lists.apache.org/thread/t8q6fmh3o6yqmy69qtqxppk9yg9wfybgMailing List, Vendor Advisory

Timeline

Published: Nov 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-446364.6The Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is CVE-2022-446376.1Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile CVE-2022-446388.8In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an intege CVE-2022-44645.4Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them b CVE-2022-446409.8Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distrib CVE-2022-446416.5In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that caus CVE-2022-446438.8A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. I CVE-2022-446446.5In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary loca CVE-2022-446458.8In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact ex CVE-2022-446465.3In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings CVE-2022-446475.5An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive inf CVE-2022-446485.5An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive inf