CVE-2024-23687

Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/advisories/GHSA-vf78-3q9f-92g3	Third Party Advisory
https://github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446	Patch
https://github.com/folio-org/mod-data-export-spring/security/advisories/GHSA-vf78-3q9f-92g3	Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-vf78-3q9f-92g3	Third Party Advisory
https://wiki.folio.org/x/hbMMBw	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openlibraryfoundation:mod-data-export-spring::::::::
	cpe:2.3:a:openlibraryfoundation:mod-data-export-spring::::::::

History

No history.

Information

Published : 2024-01-19 22:15

Updated : 2024-01-26 16:54

NVD link : CVE-2024-23687

Mitre link : CVE-2024-23687

CVE.ORG link : CVE-2024-23687

JSON object : View

Products Affected

openlibraryfoundation

mod-data-export-spring

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2024-23687", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2024-01-19T22:15:08.517", "references": [{"url": "https://github.com/advisories/GHSA-vf78-3q9f-92g3", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/folio-org/mod-data-export-spring/security/advisories/GHSA-vf78-3q9f-92g3", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-vf78-3q9f-92g3", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://wiki.folio.org/x/hbMMBw", "tags": ["Patch", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines.\n\n"}, {"lang": "es", "value": "Las credenciales codificadas en las versiones FOLIO mod-data-export-spring anteriores a 1.5.4 y de 2.0.0 a 2.0.2 permiten a usuarios no autenticados acceder a API cr\u00edticas, modificar datos de usuario, modificar configuraciones, incluido el inicio de sesi\u00f3n \u00fanico, y manipular tarifas/multas."}], "lastModified": "2024-01-26T16:54:13.900", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openlibraryfoundation:mod-data-export-spring:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF023FD8-0E0B-4208-BDB3-8F9F73A25B45", "versionEndExcluding": "1.5.4"}, {"criteria": "cpe:2.3:a:openlibraryfoundation:mod-data-export-spring:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC95B1BE-9BE8-4C31-B57B-9E4E09E14745", "versionEndExcluding": "2.0.2", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}