CVE-2020-17514: Apache Fineract

High severity, CVSS 7.4. EPSS: 3.4% chance of exploitation in the next 30 days.

Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful.

Affected products

• Apache Fineract: before 1.5.0 (fixed in 1.5.0)

Published 2021-05-27. Last modified 2026-06-17.