Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations incl…
Critical CVSS 9.1
Summary
Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines.
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Lint boundary warnings (2)
The following non-blocking warnings were raised during the lint phase of this triage (e.g. reference URLs not yet on the allowlist). They do not affect entry usability and are disclosed for transparency (see DR-002).
-
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://wiki.folio.org/x/hbMMBw -
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://wiki.folio.org/x/hbMMBw
Sources
- NVD DATABASE
Original Links
- https://github.com/advisories/GHSA-vf78-3q9f-92g3 Third Party Advisory
- https://github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446 Patch
- https://github.com/folio-org/mod-data-export-spring/security/advisories/GHSA-vf78-3q9f-92g3 Vendor Advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-vf78-3q9f-92g3 Third Party Advisory
- https://wiki.folio.org/x/hbMMBw Patch
- https://github.com/advisories/GHSA-vf78-3q9f-92g3 Third Party Advisory
- https://github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446 Patch
- https://github.com/folio-org/mod-data-export-spring/security/advisories/GHSA-vf78-3q9f-92g3 Vendor Advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-vf78-3q9f-92g3 Third Party Advisory
- https://wiki.folio.org/x/hbMMBw Patch
Timeline
- nvd_ingest NVD