CVE-2024-23687: 
Java vulnerability analysis and mitigation

Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs. The vulnerability was discovered in July 2023 and affects the FOLIO data export spring module (GitHub Advisory).

The vulnerability stems from hard-coded system user credentials in the source code that are used for internal module-to-module operations. The issue has a CVSS score of 10.0 (Critical) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. This indicates network accessibility, low attack complexity, no privileges required, and no user interaction needed (GitHub Advisory).

The vulnerability allows unauthorized access to potentially dangerous APIs, enabling attackers to: view and modify configuration including single-sign-on configuration, read/add/modify user data, and read/transfer fees/fines in patron accounts (GitHub Advisory).

Users should upgrade mod-data-export-spring to version 2.0.2 or later, or to version 1.5.4 or later in the 1.5.x series. There are no known workarounds for this vulnerability (GitHub Advisory).