org.folio vulnerabilities

Products

• org.folio/mod-data-export-spring 1
• org.folio/mod-remote-storage 1
• org.folio/spring-module-core 1

Latest org.folio CVEs

Newest publication first

1. CVE-2022-4963 Folio Spring Module Core Schema Name HibernateSchemaService.java dropSchema sql injection

   Published 2024-03-20

   Critical·CVSS 9.8 EPSS 0.59%

   A vulnerability was found in Folio Spring Module Core up to 1.1.5. It has been rated as critical. Affected by this issue is the function dropSchema of the file tenant/src/main/java/org/folio/spring/tenant/hibernate/HibernateSchemaService.java of the component Schema Name Handler....

2. CVE-2024-23687 FOLIO mod-data-export-spring Hard-Coded Credentials

   Published 2024-01-19

   Critical·CVSS 9.1 EPSS 0.65%

   Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines.

3. CVE-2024-23685 FOLIO mod-remote-storage Hard Coded Credentials

   Published 2024-01-19

   Medium·CVSS 5.3 EPSS 0.53%

   Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.