CVE-2024-23685
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allow unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.
Risk Assessment
The risk is unauthorized access to sensitive library data, potentially leading to information disclosure about collections and compromising system confidentiality.
Recommendation
Immediately upgrade mod-remote-storage to version 1.7.2 or later (for 1.x branch) and to version 2.0.4 or later (for 2.x branch), and change all default credentials.
Original NVD description (English source)
Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.