Lucene search

PalantirCVE-2023-30956

HistoryJul 10, 2023 - 10:15 p.m.

CVE-2023-30956

2023-07-1022:15:09

CWE-639

Palantir

web.nvd.nist.gov

cve-2023-30956

foundry comments

security defect

attachment

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

25.2%

JSON

A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.

Affected configurations

Nvd

Node

palantirfoundry_commentsRange<2.267.0

VendorProductVersionCPE
palantirfoundry_comments*cpe:2.3:a:palantir:foundry_comments:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
palantir	foundry_comments	*	cpe:2.3:a:palantir:foundry_comments::::::::

CNA Affected

[
  {
    "vendor": "Palantir",
    "product": "com.palantir.comments:comments",
    "versions": [
      {
        "version": "*",
        "versionType": "semver",
        "lessThan": "2.267.0",
        "status": "affected"
      }
    ]
  }
]

References

palantir.safebase.us/?tcuUid=40367943-738c-4e69-b852-4a503c77478a

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

25.2%

JSON

Related for CVE-2023-30956