Hard-coded credentials in org.folio:mod-data-export-spring
Critical severity
GitHub Reviewed
Published
Jan 20, 2024
to the GitHub Advisory Database
•
Updated Jan 26, 2024
Package
Affected versions
< 1.5.4
>= 2.0.0, < 3.0.0
Patched versions
1.5.4
3.0.0
Description
Published by the National Vulnerability Database
Jan 19, 2024
Published to the GitHub Advisory Database
Jan 20, 2024
Reviewed
Jan 22, 2024
Last updated
Jan 26, 2024
Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines.
References