GHSA-hv5g-q4h3-64q4

Suggest an improvement
Source
https://github.com/advisories/GHSA-hv5g-q4h3-64q4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-hv5g-q4h3-64q4/GHSA-hv5g-q4h3-64q4.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-hv5g-q4h3-64q4
Aliases
Published
2024-01-19T21:30:37Z
Modified
2024-01-30T20:13:29.408709Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Hard-coded credentials in org.folio:mod-remote-storage
Details

Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.

Database specific
{
    "nvd_published_at": "2024-01-19T21:15:10Z",
    "cwe_ids": [
        "CWE-798"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-23T14:35:53Z"
}
References

Affected packages

Maven / org.folio:mod-remote-storage

Package

Name
org.folio:mod-remote-storage
View open source insights on deps.dev
Purl
pkg:maven/org.folio/mod-remote-storage

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.0.3

Maven / org.folio:mod-remote-storage

Package

Name
org.folio:mod-remote-storage
View open source insights on deps.dev
Purl
pkg:maven/org.folio/mod-remote-storage

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.7.2