CVE-2023-30956

The CVE-2023-30956 entry concerns Palantir Foundry Comments where an issue allowed a user to retrieve the contents of an attachment submitted to another comment by knowing the target attachment’s internal UUID. The root cause is an insecure IDOR-like access path that exposes attachment contents. ...

CVE-2023-30948

Foundry Comments contains a vulnerability where attachments to comments were not gated by authorization checks, allowing an authenticated user to inject a known attachment UUID into other comments to view its content. Affected products: Foundry Comments versions prior to 2.249.0. Root cause: miss...