-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from hard-coded 'system-user' credentials used for internal module operations. The patch (57df495) replaced static credentials with environment variables (SYSTEM_USER_NAME/SYSTEM_USER_PASSWORD). Key evidence includes: 1) Removal of the SYSTEM_USER constant from TenantController, 2) Introduction of @Value injections for username/password, 3) SecurityManagerService method calls being updated to use injected values instead of literals. The identified functions directly handled authentication logic using hard-coded values before the patch.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.folio:mod-remote-storage | maven | >= 2.0.0, < 2.0.3 | 2.0.3 |
| org.folio:mod-remote-storage | maven | < 1.7.2 | 1.7.2 |