{"affected":[{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"org.folio:mod-data-export-spring","product":"","source":"CNA: VulnCheck","vendor":"","versions":[{"lessThan":"1.5.4","status":"affected","version":"0","versionType":"maven"},{"lessThan":"2.0.2","status":"affected","version":"2.0.0","versionType":"maven"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"org.folio:mod-data-export-spring","product":"org.folio:mod-data-export-spring","source":"OSV GHSA-vf78-3q9f-92g3","vendor":"","versions":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.0.2"}],"status":"unknown","version":"2.0.0","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"org.folio:mod-data-export-spring","product":"org.folio:mod-data-export-spring","source":"OSV GHSA-vf78-3q9f-92g3","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"1.5.4"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2024-23687","cwes":["CWE-798"],"description":"Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines.","epss":{"date":"2026-11-08","percentile":0.51508,"score":0.00652},"exploits":[],"kev":null,"metrics":[{"score":9.1,"severity":"critical","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794146402835,"publishedAt":1705698918503,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/folio-org/mod-data-export-spring/security/advisories/GHSA-vf78-3q9f-92g3"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446"},{"source":"CNA: VulnCheck","tags":["related"],"url":"https://wiki.folio.org/x/hbMMBw"},{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/advisories/GHSA-vf78-3q9f-92g3"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-vf78-3q9f-92g3"},{"source":"ADP: CVE","tags":["vendor-advisory","x_transferred"],"url":"https://github.com/folio-org/mod-data-export-spring/security/advisories/GHSA-vf78-3q9f-92g3"},{"source":"ADP: CVE","tags":["patch","x_transferred"],"url":"https://github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446"},{"source":"ADP: CVE","tags":["related","x_transferred"],"url":"https://wiki.folio.org/x/hbMMBw"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://github.com/advisories/GHSA-vf78-3q9f-92g3"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-vf78-3q9f-92g3"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-vf78-3q9f-92g3"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-vf78-3q9f-92g3"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446"},{"kind":"fix","source":"ADP: CVE","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446"},{"kind":"fix","source":"OSV GHSA-vf78-3q9f-92g3","text":"org.folio:mod-data-export-spring (Maven): OSV reports a fixed version 2.0.2. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-vf78-3q9f-92g3"},{"kind":"fix","source":"OSV GHSA-vf78-3q9f-92g3","text":"org.folio:mod-data-export-spring (Maven): OSV reports a fixed version 1.5.4. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-vf78-3q9f-92g3"}],"revision":"49020be5f051cf62d12aadab547a10591c9d8a3bd2ebfd7833af257415782a6a","sources":[{"modifiedAt":1794146402835,"name":"CNA: VulnCheck","retrievedAt":1794146943150,"url":"https://www.cve.org/CVERecord?id=CVE-2024-23687"},{"modifiedAt":1783492191814,"name":"OSV / GitHub Security Advisories","retrievedAt":1794146943597,"url":"https://osv.dev/vulnerability/GHSA-vf78-3q9f-92g3"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150558030,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-23687"}],"ssvc":{"assessedAt":1706124265245,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"FOLIO mod-data-export-spring Hard-Coded Credentials","updatedAt":1794150558030}