PT-2023-32947 · Unknown · Mod-Inventory-Storage+1

CVE-2024-23685 · Published 2023-07-25 · Updated 2024-01-26

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions mod-remote-storage versions under 1.7.2 mod-remote-storage versions 2.0.0 through 2.0.3

Description The issue concerns hard-coded credentials in the mod-remote-storage module, allowing unauthorized users to gain read access to mod-inventory-storage records. This includes records marked as suppressed from discovery, such as instances, holdings, items, contributor-types, and identifier-types.

Recommendations Upgrade mod-remote-storage to version 1.7.2 or later for versions under 1.7.2. Upgrade mod-remote-storage to version 2.0.4 or later for versions 2.0.0 through 2.0.3.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2024-23685

GHSA-HV5G-Q4H3-64Q4

GHSA-M8V7-469P-5X89

Affected Products

Mod-Inventory-Storage

Mod-Remote-Storage

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23685.json · Exploit
• https://github.com/folio-org/mod-remote-storage/commit/57df495f76e9aa5be9ce7ce3a65f89b6dbcbc13b · Patch
• https://github.com/folio-org/mod-remote-storage/security/advisories/GHSA-m8v7-469p-5x89 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23685 · Security Note
• https://github.com/advisories/GHSA-m8v7-469p-5x89 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hv5g-q4h3-64q4 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m8v7-469p-5x89 · Vendor Advisory
• https://wiki.folio.org/x/hbMMBw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23685 · Vendor Advisory
• https://github.com/folio-org/mod-remote-storage · Note
• https://repo.maven.apache.org/maven2 · Note
• https://vulncheck.com/advisories/vc-advisory-GHSA-m8v7-469p-5x89 · Note
• https://twitter.com/VulmonFeeds/status/1748490752269684789 · Twitter Post
• https://t.me/cvenotify/68928 · Telegram Post
• https://twitter.com/CVEnew/status/1748454630772834575 · Twitter Post