Publish GHSA-m8v7-469p-5x89

Author: advisory-database[bot]

advisories/github-reviewed/2023/07/GHSA-m8v7-469p-5x89/GHSA-m8v7-469p-5x89.json

@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m8v7-469p-5x89",
-  "modified": "2023-07-25T14:44:27Z",
+  "modified": "2026-01-22T20:40:36Z",
   "published": "2023-07-25T14:44:27Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2024-23685"
+  ],
   "summary": "Hard-coded System User Credentials in Folio Data Export Spring module ",
   "details": "### Impact\nThe module creates a system user that is used to perform internal module-to-module operations.  Credentials for this user are hard-coded in the source code.  This makes it trivial to authenticate as this user, allowing unauthorized read access to these mod-inventory-storage records: instances, holdings, items, contributor-types, identifier-types. This includes records marked as suppressed from discovery.\n\n### Patches\nUpgrade mod-remote-storage to >=2.0.3, or a 1.7.x version >=1.7.1.\n\n### Workarounds\nNo known workarounds.\n\n### References\nhttps://wiki.folio.org/x/hbMMBw - FOLIO Security Advisory with Upgrade Instructions\nhttps://github.com/folio-org/mod-remote-storage/commit/57df495f76e9aa5be9ce7ce3a65f89b6dbcbc13b - Fix",
   "severity": [
@@ -57,6 +59,10 @@
       "type": "WEB",
       "url": "https://github.com/folio-org/mod-remote-storage/security/advisories/GHSA-m8v7-469p-5x89"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23685"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/folio-org/mod-remote-storage/commit/57df495f76e9aa5be9ce7ce3a65f89b6dbcbc13b"
@@ -65,13 +71,19 @@
       "type": "PACKAGE",
       "url": "https://github.com/folio-org/mod-remote-storage"
     },
+    {
+      "type": "WEB",
+      "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-m8v7-469p-5x89"
+    },
     {
       "type": "WEB",
       "url": "https://wiki.folio.org/x/hbMMBw"
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-798"
+    ],
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2023-07-25T14:44:27Z",