Lucene search

PalantirCVELIST:CVE-2023-30956

HistoryJul 10, 2023 - 9:07 p.m.

CVE-2023-30956 IDOR in Foundry Comments allows retrieval of attachments

2023-07-1021:07:31

CWE-639

Palantir

www.cve.org

cve-2023-30956

foundry comments

idor

vulnerability

unauthorized retrieval

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

25.2%

JSON

A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.

CNA Affected

[
  {
    "vendor": "Palantir",
    "product": "com.palantir.comments:comments",
    "versions": [
      {
        "version": "*",
        "versionType": "semver",
        "lessThan": "2.267.0",
        "status": "affected"
      }
    ]
  }
]

References

palantir.safebase.us/?tcuUid=40367943-738c-4e69-b852-4a503c77478a

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

25.2%

JSON

Related for CVELIST:CVE-2023-30956