Lucene search

PalantirCVELIST:CVE-2023-30956

HistoryJul 10, 2023 - 9:07 p.m.

CVE-2023-30956 IDOR in Foundry Comments allows retrieval of attachments

2023-07-1021:07:31

CWE-639

Palantir

www.cve.org

cve-2023-30956

foundry comments

idor

vulnerability

unauthorized retrieval

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

5.5 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

19.0%

JSON

A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.

CNA Affected

[
  {
    "vendor": "Palantir",
    "product": "com.palantir.comments:comments",
    "versions": [
      {
        "version": "*",
        "versionType": "semver",
        "lessThan": "2.267.0",
        "status": "affected"
      }
    ]
  }
]

References

palantir.safebase.us/?tcuUid=40367943-738c-4e69-b852-4a503c77478a

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

5.5 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

19.0%

JSON

Related for CVELIST:CVE-2023-30956