Lucene search

PalantirCVELIST:CVE-2023-30946

HistoryJun 29, 2023 - 6:49 p.m.

CVE-2023-30946 Issues notification metadata lacks authorization

2023-06-2918:49:23

CWE-420

CWE-288

Palantir

www.cve.org

cve-2023-30946

foundry issues

security defect

unauthorized metadata access

notification api

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry’s Notification API and receive metadata about the issue including the RID of the issue, severity, internal UUID of the author, and the user-defined title of the issue.

CNA Affected

[
  {
    "vendor": "Palantir",
    "product": "com.palantir.issues:issues",
    "versions": [
      {
        "version": "*",
        "versionType": "semver",
        "lessThan": "2.497.0",
        "status": "affected"
      }
    ]
  }
]

References

palantir.safebase.us/?tcuUid=4cf0b6e6-564a-467b-83ae-36fec3a491c3

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

Related for CVELIST:CVE-2023-30946