Lucene search
HistoryJul 10, 2023 - 10:15 p.m.
CVE-2023-30956
cve-2023-30956
foundry comments
user discovery
CVSS3
5.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
0.001
Percentile
25.2%
A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.
Affected configurations
Node
palantirfoundry_commentsRange<2.267.0
| Vendor | Product | Version | CPE |
|---|---|---|---|
| palantir | foundry_comments | * | cpe:2.3:a:palantir:foundry_comments:*:*:*:*:*:*:*:* |
Related
prion
prion
Code injection
2023-07-10 22:15:00
cvelist
cvelist
CVE-2023-30956 IDOR in Foundry Comments allows retrieval of attachments
2023-07-10 21:07:31
cve
cve
CVE-2023-30956
2023-07-10 22:15:09
CVSS3
5.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
0.001
Percentile
25.2%
Related for NVD:CVE-2023-30956