Hard-coded System User Credentials in Folio Data Export Spring module

中 5.3CVE-2024-23685 · GHSA-m8v7-469p-5x89 · 19/01/2024 公開 · 14/07/2026 更新

要点

CVE-2024-23685 は org.folio:mod-remote-storage, mod-remote-storage (openlibraryfoundation) に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.53%（全脆弱性の 44.8% より高い）。
対処：2.0.3, 1.7.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.folio:mod-remote-storage Maven	`≥ 2.0.0, < 2.0.3< 1.7.2`	`2.0.31.7.2`
mod-remote-storage openlibraryfoundation	`≥ 2.0.0, < 2.0.3< 1.7.2`	`2.0.31.7.2`

概要

Impact

The module creates a system user that is used to perform internal module-to-module operations. Credentials for this user are hard-coded in the source code. This makes it trivial to authenticate as this user, allowing unauthorized read access to these mod-inventory-storage records: instances, holdings, items, contributor-types, identifier-types. This includes records marked as suppressed from discovery.

Patches

Upgrade mod-remote-storage to >=2.0.3, or a 1.7.x version >=1.7.1.

Workarounds

No known workarounds.

References

https://wiki.folio.org/x/hbMMBw - FOLIO Security Advisory with Upgrade Instructions https://github.com/folio-org/mod-remote-storage/commit/57df495f76e9aa5be9ce7ce3a65f89b6dbcbc13b - Fix

NVD の説明

Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.