CVE-2025-23408— Apache Fineract: weak password policy
Quick assessment
Affected
Apache Software Foundation Apache Fineract
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Fineract是美国阿帕奇（Apache）基金会的一套开源数字金融服务平台。该平台能够为用户提供数据管理、贷款和储蓄投资组合管理以及实时财务数据等功能。 Apache Fineract 1.10.1及之前版本存在安全漏洞，该漏洞源于密码要求弱。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-23408
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Fineract: weak password policy
Source: CVE Program / CVE List V5
Vulnerability Description
Weak Password Requirements vulnerability in Apache Fineract.
This issue affects Apache Fineract: through 1.10.1. The issue is fixed in version 1.11.0.
Users are encouraged to upgrade to version 1.13.0, the latest release.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
弱口令要求
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Fineract 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Fineract是美国阿帕奇（Apache）基金会的一套开源数字金融服务平台。该平台能够为用户提供数据管理、贷款和储蓄投资组合管理以及实时财务数据等功能。 Apache Fineract 1.10.1及之前版本存在安全漏洞，该漏洞源于密码要求弱。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Fineract | 0 ~ 1.10.1 | - |
|
II. Public POCs for CVE-2025-23408
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-23408
请登录查看更多情报信息。
Mailing List Discussions for CVE-2025-23408 (1)
-
https://lists.apache.org/thread/bdlb6wl968yh1n48mr5npsk2spo6dncf vendor-advisory
Same Patch Batch · Apache Software Foundation · 2025-12-12 · 7 CVEs total
| CVE-2025-53960 | Apache StreamPark: Uses the user’s password as the secret key | |
| CVE-2025-54947 | Apache StreamPark: Use hard-coded key vulnerability | |
| CVE-2025-54981 | Apache StreamPark: Weak Encryption Algorithm in StreamPark | |
| CVE-2025-26866 | Apache HugeGraph-Server: RAFT and deserialization vulnerability | |
| CVE-2025-58137 | Apache Fineract: IDOR via self-service API | |
| CVE-2025-58130 | Apache Fineract: Server Key not masked |
IV. Related Vulnerabilities
Same product: Apache Fineract
-
CVE-2026-57821
Apache Fineract: Office list: SQL Injection via Subquery in -
CVE-2026-35152
Apache Fineract: SQL injection in runreports endpoint -
CVE-2026-56287
Apache Fineract: Boolean SQL Injection in Client Search API -
CVE-2025-58137
Apache Fineract: IDOR via self-service API -
CVE-2025-58130
Apache Fineract: Server Key not masked
Same vendor: Apache Software Foundation
-
CVE-2026-63686
Apache HTTP Server: mod_xml2enc crash on charset conversion -
CVE-2026-93546
Apache HTTP Server: mod_dav_fs namespace overflow -
CVE-2026-79768
Apache HTTP Server: mod_userdir information disclosure -
CVE-2026-73637
Apache HTTP Server: mod_auth_digest DoS attack -
CVE-2026-73636
Apache HTTP Server: mod_auth_digest one-time-nonce replay at
Same weakness: CWE-521
V. Comments for CVE-2025-23408
No comments yet