CVE-2024-23685: 
Java vulnerability analysis and mitigation

A hard-coded system user credentials vulnerability was discovered in the Folio Data Export Spring module (org.folio:mod-remote-storage) affecting versions >=2.0.0, <2.0.3 and <1.7.2. The vulnerability was published on July 24, 2023, and has been assigned identifier GHSA-m8v7-469p-5x89. The issue affects the module's system user that is used for internal module-to-module operations (GitHub Advisory).

The vulnerability stems from hard-coded credentials in the source code for a system user that performs internal module-to-module operations. The issue has been assigned a CVSS v3.1 score of 5.3 (Moderate severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-798 (GitHub Advisory).

The vulnerability allows unauthorized read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types. Notably, this access extends to records that are marked as suppressed from discovery (GitHub Advisory).

Users should upgrade mod-remote-storage to version >=2.0.3, or to a 1.7.x version >=1.7.2. No alternative workarounds are available (GitHub Advisory).