Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.
{
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23685.json"
}{
"extracted_events": [
{
"cpe": "cpe:2.3:a:openlibraryfoundation:mod-remote-storage:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.7.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:openlibraryfoundation:mod-remote-storage:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.3"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "57df495f76e9aa5be9ce7ce3a65f89b6dbcbc13b"
}
],
"source": "REFERENCES_COMMIT"
}
]
}