Open-source package vulnerability · Maven

GHSA-9rhq-86fm-qxqc: Duplicate Advisory: Hard-coded credentials in org.folio:mod-data-export-spring

criticalCVSS 3.1 9.1

This advisory was withdrawn on Jan 22, 2026. The publisher no longer considers it a valid vulnerability.

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vf78-3q9f-92g3. This link is maintained to preserve external references. Original Description Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate…

Published Jan 20, 2024 · Updated Jan 22, 2026

Affected packages

org.folio:mod-data-export-spring

Ecosystem: Maven
Affected: < 1.5.4
Fixed in: 1.5.4
Check: mvn dependency:tree -Dincludes=org.folio:mod-data-export-spring

org.folio:mod-data-export-spring

Ecosystem: Maven
Affected: >= 2.0.0, < 3.0.0
Fixed in: 3.0.0
Check: mvn dependency:tree -Dincludes=org.folio:mod-data-export-spring

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-vf78-3q9f-92g3. This link is maintained to preserve external references.

Original Description

Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology