PT-2023-32949 · Folio · Mod-Data-Export-Spring

Published 2023-07-25 · Updated 2025-11-29 · CVE-2024-23687

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FOLIO mod-data-export-spring versions before 1.5.4 FOLIO mod-data-export-spring versions from 2.0.0 to 2.0.2

Description The issue concerns hard-coded credentials in the mod-data-export-spring module, allowing unauthenticated users to access critical APIs. This results in unauthorized access to potentially dangerous APIs, enabling the modification of user data, configurations including single-sign-on, and the manipulation of fees/fines in a patron's account. The module creates a system user for internal operations, and the hard-coded credentials for this user make it easy to authenticate and gain unauthorized access.

Recommendations For FOLIO mod-data-export-spring versions before 1.5.4, upgrade to version 1.5.4 or later. For FOLIO mod-data-export-spring versions from 2.0.0 to 2.0.2, upgrade to version 2.0.2 or later.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2024-23687

GHSA-9RHQ-86FM-QXQC

GHSA-VF78-3Q9F-92G3

Affected Products

Mod-Data-Export-Spring

References · 14

• https://github.com/folio-org/mod-data-export-spring/security/advisories/GHSA-vf78-3q9f-92g3 · Vendor Advisory
• https://github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446 · Patch
• https://wiki.folio.org/x/hbMMBw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23687 · Security Note
• https://osv.dev/vulnerability/GHSA-9rhq-86fm-qxqc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23687 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vf78-3q9f-92g3 · Vendor Advisory
• https://github.com/folio-org/mod-data-export-spring · Note
• https://github.com/folio-org/mod-data-export-spring/commit/cb6785565067a2a90c1e2250c241e5b23214c691 · Note
• https://t.me/cvenotify/68094 · Telegram Post
• https://github.com/advisories/GHSA-vf78-3q9f-92g3 · Note
• https://vulncheck.com/advisories/vc-advisory-GHSA-vf78-3q9f-92g3 · Note
• https://t.me/cveNotify/144316 · Telegram Post
• https://twitter.com/CVEnew/status/1748456538564395405 · Twitter Post