Duplicate Advisory: Hard-coded credentials in org.folio:mod-data-export-spring
Date: 2024-01
Affected: maven/org.folio:mod-data-export-spring, maven/org.folio:mod-data-export-spring
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2024-23687
CWE: CWE-798
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vf78-3q9f-92g3. This link is maintained to preserve external references. ## Original Description Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines.


Mitigations:

Architectural layers (MAESTRO):