CVE-2024-23687

CriticalCVSS 9.1

Published: 19/01/2024(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.65%

47th percentile - higher than 47% of all known CVEs

Summary

Hard-coded credentials in FOLIO mod-data-export-spring before version 1.5.4 and from 2.0.0 to 2.0.2 allow unauthenticated users to access critical APIs, modify user data, change configurations including single-sign-on, and manipulate fees/fines.

Risk Assessment

The organization is exposed to unauthorized access to sensitive data and system functions, potentially leading to data integrity breaches, user account takeover, and financial losses.

Recommendation

Immediately upgrade mod-data-export-spring to version 1.5.4 or later (for 1.x branch) or to version 2.0.3 or later (for 2.x branch).

Original NVD description (English source)

Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines.