{"id":"CVE-2025-58130","summary":"Apache Fineract: Server Key not masked","details":"Insufficiently Protected Credentials vulnerability in Apache Fineract.\n\nThis issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1.\n\nUsers are encouraged to upgrade to version 1.13.0, the latest release.","modified":"2026-08-12T15:16:53.111723Z","published":"2025-12-12T09:20:06.930Z","database_specific":{"cwe_ids":["CWE-522"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58130.json","unresolved_ranges":[{"extracted_events":[{"last_affected":"1.11.0"}],"source":"AFFECTED_FIELD"},{"extracted_events":[{"fixed":"1.11.0"}],"source":"DESCRIPTION"}],"cna_assigner":"apache"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/12/11/6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58130.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/d9zpkc86zk265523tfvbr8w7gyr6onoy"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58130"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/fineract","events":[{"introduced":"0"},{"fixed":"c84ba089f0f2f04aff8ca14d930e3328dc78a2ce"}],"database_specific":{"cpe":"cpe:2.3:a:apache:fineract:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.12.1"}],"source":"CPE_RANGE"}}],"versions":["1.12.0","1.11.0","1.10.0","1.9.0","1.5.0","1.3.0","1.2.0","1.1.0","1.0.0"],"database_specific":{"vanir_signatures":[{"id":"CVE-2025-58130-ad985199","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fineract/commit/c84ba089f0f2f04aff8ca14d930e3328dc78a2ce","target":{"file":"fineract-progressive-loan/src/main/java/org/apache/fineract/portfolio/loanaccount/domain/transactionprocessor/impl/AdvancedPaymentScheduleTransactionProcessor.java","function":"calculateUnrecognizedInterestForClosedPeriodByInterestRecalculationStrategy"},"deprecated":false,"digest":{"function_hash":"247025461354035783428261568913895953285","length":742}},{"source":"https://github.com/apache/fineract/commit/c84ba089f0f2f04aff8ca14d930e3328dc78a2ce","target":{"file":"fineract-progressive-loan/src/main/java/org/apache/fineract/portfolio/loanaccount/domain/transactionprocessor/impl/AdvancedPaymentScheduleTransactionProcessor.java","function":"adjustOverduePrincipalForInstallment"},"deprecated":false,"digest":{"function_hash":"258811801508625934989384141179698373889","length":1017},"id":"CVE-2025-58130-dacf83b4","signature_type":"Function","signature_version":"v1"},{"target":{"file":"fineract-progressive-loan/src/main/java/org/apache/fineract/portfolio/loanaccount/domain/transactionprocessor/impl/AdvancedPaymentScheduleTransactionProcessor.java"},"deprecated":false,"digest":{"line_hashes":["138191747758501280337960127024677382029","255395756862878314783565890472405382250","5365675856227064694452025375135079376","331257332888361575781293018629534375181","199293117384997593102896058170095822260","221100182536094384892271984485565355450","74223737524375293603034164231074061537","97800999851060569669571911513478748535","267862928392344728320129751297752642657","275440475449886244259590698165737049668","330727221590580003342371874896986011104","2175058152260346297583165779496235334","194099676269294820361048358761390430291","51730088082740275013536685122151133405","290141532093220642307379435144962844406","253835298966877416278044200935455305122","51015104690728200055632743290849929888","84596213177439866953171052462631784305","180273124232249494992383018595902358336","236492209710466230327066768749823003676","173341809459466510007909743894208652771","238643992063912299794608947725547896005","145364953438672618517704107984324200456","287612857909205842301161899324226274447","118515589070690815710810658671221757056","148544143335794828920886998307707163898","38974284425882772250680296062765942367","108587633537507210242609878158511307392","165144164598132128230325941377207541487","316310132344573171261707929349455732216","97040418730218333081137696248327065966"],"threshold":0.9},"id":"CVE-2025-58130-dfdaadbb","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/fineract/commit/c84ba089f0f2f04aff8ca14d930e3328dc78a2ce"},{"deprecated":false,"digest":{"function_hash":"333876918323615988029307178929795569855","length":271},"id":"CVE-2025-58130-f81c7948","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fineract/commit/c84ba089f0f2f04aff8ca14d930e3328dc78a2ce","target":{"file":"fineract-progressive-loan/src/main/java/org/apache/fineract/portfolio/loanaccount/domain/transactionprocessor/impl/AdvancedPaymentScheduleTransactionProcessor.java","function":"handleRepayment"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58130.json","vanir_signatures_modified":"2026-08-12T15:16:53Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}