Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.folio:mod-remote-storage

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3MavenPublished

    Hard-coded System User Credentials in Folio Data Export Spring module

    CVE-2024-23685 · GHSA-m8v7-469p-5x89

    Affected
    • Maven org.folio:mod-remote-storage >= 2.0.0, < 2.0.3; < 1.7.2
    Fixed in
    2.0.31.7.2· Vendor fix available
    Issue
    Impact The module creates a system user that is used to perform internal module-to-module operations. Credentials for this user are hard-coded in the source code. This makes it trivial to authenticate as this user, allowing unauthorized read access to these mod-inventory-storage records: instances, holdings, items, contributor-types, identifier-types. This includes records marked as suppressed from discovery. Patches Upgrade mod-remote-storage to =2.0.3, or a 1.7.x version =1.7.1. Workarounds No known workarounds. References https://wiki.folio.org/x/hbMMBw - FOLIO Security Advisory with Upgrade Instructions https://github.com/folio-org/mod-remote-storage/commit/57df495f76e9aa5be9ce7ce3a65f89b6dbcbc13b - Fix

    Recommended action: Upgrade to 2.0.3 or 1.7.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →