Use of Hard-coded Credentials Affecting org.folio:mod-data-export-spring package, versions [,3.0.0)


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.2% (59th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JAVA-ORGFOLIO-5806573
  • published26 Jul 2023
  • disclosed25 Jul 2023
  • creditUnknown

Introduced: 25 Jul 2023

CVE-2024-23687  (opens in a new tab)
CWE-798  (opens in a new tab)

How to fix?

Upgrade org.folio:mod-data-export-spring to version 3.0.0 or higher.

Overview

Affected versions of this package are vulnerable to Use of Hard-coded Credentials. The module creates a system user that is used to perform internal module-to-module operations. Credentials for this user are hard-coded in the source code. This makes it trivial to authenticate as this user, resulting in unauthorized access to potentially dangerous APIs, allowing to view and modify configuration including single-sign-on configuration, to read, add and modify user data, and to read and transfer fees/fines in a patron's account.

References

CVSS Scores

version 3.1