Lucene search

[email protected]NVD:CVE-2024-23687

HistoryJan 19, 2024 - 10:15 p.m.

CVE-2024-23687

2024-01-1922:15:08

CWE-798

[email protected]

web.nvd.nist.gov

cve-2024-23687

hard-coded credentials

folio mod-data-export-spring

unauthenticated access

critical apis

user data

configurations

single-sign-on

fees/fines

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.6%

JSON

Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines.

Affected configurations

NVD

Node

openlibraryfoundationmod-data-export-springRange<1.5.4

openlibraryfoundationmod-data-export-springRange2.0.0–2.0.2

References

github.com/advisories/GHSA-vf78-3q9f-92g3

github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446

github.com/folio-org/mod-data-export-spring/security/advisories/GHSA-vf78-3q9f-92g3

vulncheck.com/advisories/vc-advisory-GHSA-vf78-3q9f-92g3

wiki.folio.org/x/hbMMBw

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.6%

JSON

Related for NVD:CVE-2024-23687

osv3 github1 prion1 cve1 cvelist1