PT-2023-32949 · Folio · Mod-Data-Export-Spring

CVE-2024-23687 · Publicado 2023-07-25 · Atualizado 2025-11-29

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FOLIO mod-data-export-spring versions before 1.5.4 FOLIO mod-data-export-spring versions from 2.0.0 to 2.0.2

Description The issue concerns hard-coded credentials in the mod-data-export-spring module, allowing unauthenticated users to access critical APIs. This results in unauthorized access to potentially dangerous APIs, enabling the modification of user data, configurations including single-sign-on, and the manipulation of fees/fines in a patron's account. The module creates a system user for internal operations, and the hard-coded credentials for this user make it easy to authenticate and gain unauthorized access.

Recommendations For FOLIO mod-data-export-spring versions before 1.5.4, upgrade to version 1.5.4 or later. For FOLIO mod-data-export-spring versions from 2.0.0 to 2.0.2, upgrade to version 2.0.2 or later.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2024-23687

GHSA-9RHQ-86FM-QXQC

GHSA-VF78-3Q9F-92G3

Produtos afetados

Mod-Data-Export-Spring

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23687.json · Exploit
• https://github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446 · Correção
• https://github.com/folio-org/mod-data-export-spring/security/advisories/GHSA-vf78-3q9f-92g3 · Aviso do Fabricante
• https://github.com/folio-org/mod-data-export-spring · Nota
• https://github.com/folio-org/mod-data-export-spring/commit/cb6785565067a2a90c1e2250c241e5b23214c691 · Nota
• https://repo.maven.apache.org/maven2 · Nota
• https://github.com/advisories/GHSA-vf78-3q9f-92g3 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2024-23687 · Aviso do Fabricante
• https://t.me/cveNotify/144316 · Publicação no Telegram
• https://vulncheck.com/advisories/vc-advisory-GHSA-vf78-3q9f-92g3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-23687 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-9rhq-86fm-qxqc · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vf78-3q9f-92g3 · Aviso do Fabricante
• https://wiki.folio.org/x/hbMMBw · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1748456538564395405 · Publicação no Twitter