GHSA-hv5g-q4h3-64q4

    Dashboard / Vulnerabilities / GHSA-hv5g-q4h3-64q4

    GHSA-hv5g-q4h3-64q4

    Published: 19 Jan 2024Last Modified: 10 Sept 2026

    Summary: Duplicate Advisory: Hard-coded credentials in org.folio:mod-remote-storage

    Details: ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m8v7-469p-5x89. This link is maintained to preserve external references. ## Original Description Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.

    References: https://github.com/folio-org/mod-remote-storage/security/advisories/GHSA-m8v7-469p-5x89, https://nvd.nist.gov/vuln/detail/CVE-2024-23685, https://github.com/folio-org/mod-remote-storage/commit/57df495f76e9aa5be9ce7ce3a65f89b6dbcbc13b, https://github.com/advisories/GHSA-m8v7-469p-5x89, https://github.com/folio-org/mod-remote-storage, https://vulncheck.com/advisories/vc-advisory-GHSA-m8v7-469p-5x89, https://wiki.folio.org/x/hbMMBw

    Affected packages

    Package

    Name: org.folio:mod-remote-storage

    Purl: pkg:maven/org.folio/mod-remote-storage

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 2.0.0
    Fixed -2.0.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-hv5g-q4h3-64q4 | CVE-DB