High
Security advisory
Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-17514
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:33 UTC · Revision 1
Source evidence
Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful.
osv:CVE-2020-17514
Complete source record
{
"id": "fda8c11a5f326085f97256382c806597b5662b2c4b007ff7fd8cf0a5214149ee",
"url": "https://osv.dev/vulnerability/CVE-2020-17514",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-17514",
"summary": "Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful.",
"evidence": "osv:CVE-2020-17514",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-17514",
"aliases": [
"CVE-2020-17514"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/fineract",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "f87b66d4e1beb244bb77b7f084b64e72fd3f697c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:fineract:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.5.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"1.3.0",
"1.2.0",
"1.1.0",
"1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-17514.json",
"vanir_signatures": [
{
"id": "CVE-2020-17514-22ad9a96",
"digest": {
"length": 893,
"function_hash": "106474929361225198308851064867287969644"
},
"source": "https://github.com/apache/fineract/commit/f87b66d4e1beb244bb77b7f084b64e72fd3f697c",
"target": {
"file": "fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/api/RunreportsApiResource.java",
"function": "runReport"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-17514-5e6fcf1a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"280530891970670539376843024154011340833",
"49914397998138737485537880196239095205",
"208630785006039122057017105586735474035",
"15961524931943988623102602731569372254"
]
},
"source": "https://github.com/apache/fineract/commit/f87b66d4e1beb244bb77b7f084b64e72fd3f697c",
"target": {
"file": "fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/service/ReadReportingService.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-17514-7e3c22a1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"235044639398674271974919262124490233004",
"220862674770124498097607656203942822792",
"340071168976289991808803488580652321004",
"293758616914316666127019760345790182609"
]
},
"source": "https://github.com/apache/fineract/commit/f87b66d4e1beb244bb77b7f084b64e72fd3f697c",
"target": {
"file": "fineract-provider/src/main/java/org/apache/fineract/infrastructure/reportmailingjob/service/ReportMailingJobWritePlatformServiceImpl.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-17514-946be5b1",
"digest": {
"length": 1521,
"function_hash": "150538795255760092079093291453021380984"
},
"source": "https://github.com/apache/fineract/commit/f87b66d4e1beb244bb77b7f084b64e72fd3f697c",
"target": {
"file": "fineract-provider/src/main/java/org/apache/fineract/infrastructure/reportmailingjob/service/ReportMailingJobWritePlatformServiceImpl.java",
"function": "generateReportOutputStream"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-17514-c41b6889",
"digest": {
"length": 448,
"function_hash": "258071128671093110070062218547965101331"
},
"source": "https://github.com/apache/fineract/commit/f87b66d4e1beb244bb77b7f084b64e72fd3f697c",
"target": {
"file": "fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/service/ReadReportingServiceImpl.java",
"function": "getReportType"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-17514-c8e6761e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"133901955411038297603702634634361417280",
"51969418121777140423287985491175926186",
"301273296032243751978956290713798537899",
"335937948156775573000532487112851869802"
]
},
"source": "https://github.com/apache/fineract/commit/f87b66d4e1beb244bb77b7f084b64e72fd3f697c",
"target": {
"file": "fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/api/RunreportsApiResource.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-17514-cc7202e2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"15071055183209831028850922596960473857",
"305469393546537005401088465954151196261",
"311640587452877026191815268600126891539",
"161014423631986323815603068570084703882"
]
},
"source": "https://github.com/apache/fineract/commit/f87b66d4e1beb244bb77b7f084b64e72fd3f697c",
"target": {
"file": "fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/service/ReadReportingServiceImpl.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T19:11:40Z"
}
}
],
"modified": "2026-10-24T19:11:40.872399502Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/rc011b25289c8a6e14f8bc6d07e727382a1df3c8cf2aa5369598bbf64%40%3Cdev.fineract.apache.org%3E",
"https://issues.apache.org/jira/browse/FINERACT-1211"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-17514",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 444080,
"published_at": "2021-05-27T12:15:07.733+00:00"
}