CVE-2024-23685

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23685
Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/advisories/GHSA-m8v7-469p-5x89 Third Party Advisory
https://github.com/folio-org/mod-remote-storage/commit/57df495f76e9aa5be9ce7ce3a65f89b6dbcbc13b Patch
https://github.com/folio-org/mod-remote-storage/security/advisories/GHSA-m8v7-469p-5x89 Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-m8v7-469p-5x89 Third Party Advisory
https://wiki.folio.org/x/hbMMBw Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openlibraryfoundation:mod-remote-storage:*:*:*:*:*:*:*:*
cpe:2.3:a:openlibraryfoundation:mod-remote-storage:*:*:*:*:*:*:*:*
History

26 Jan 2024, 18:15

Type Values Removed Values Added
First Time Openlibraryfoundation
Openlibraryfoundation mod-remote-storage
CPE cpe:2.3:a:openlibraryfoundation:mod-remote-storage:*:*:*:*:*:*:*:*
Summary
  • (es) Las credenciales codificadas en las versiones mod-remote-storage inferiores a 1.7.2 y 2.0.0 a 2.0.3 permiten a usuarios no autorizados obtener acceso de lectura a registros mod-inventory-storage, incluidas instancias, existencias, artículos, tipos de contribuyentes y tipos de identificadores.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CWE CWE-798
References () https://github.com/advisories/GHSA-m8v7-469p-5x89 - () https://github.com/advisories/GHSA-m8v7-469p-5x89 - Third Party Advisory
References () https://github.com/folio-org/mod-remote-storage/commit/57df495f76e9aa5be9ce7ce3a65f89b6dbcbc13b - () https://github.com/folio-org/mod-remote-storage/commit/57df495f76e9aa5be9ce7ce3a65f89b6dbcbc13b - Patch
References () https://github.com/folio-org/mod-remote-storage/security/advisories/GHSA-m8v7-469p-5x89 - () https://github.com/folio-org/mod-remote-storage/security/advisories/GHSA-m8v7-469p-5x89 - Vendor Advisory
References () https://vulncheck.com/advisories/vc-advisory-GHSA-m8v7-469p-5x89 - () https://vulncheck.com/advisories/vc-advisory-GHSA-m8v7-469p-5x89 - Third Party Advisory
References () https://wiki.folio.org/x/hbMMBw - () https://wiki.folio.org/x/hbMMBw - Patch, Vendor Advisory

19 Jan 2024, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-19 21:15

Updated : 2024-01-26 18:15

NVD link : CVE-2024-23685

Mitre link : CVE-2024-23685

CVE.ORG link : CVE-2024-23685

JSON object : View

Products Affected

openlibraryfoundation

  • mod-remote-storage
CWE
CWE-798

Use of Hard-coded Credentials