A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the RID of the issue, severity, internal UUID of the author, and the user-defined title of the issue.
References
| Link | Resource |
|---|---|
| https://palantir.safebase.us/?tcuUid=4cf0b6e6-564a-467b-83ae-36fec3a491c3 | Vendor Advisory |
Configurations
History
07 Jul 2023, 17:04
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Palantir
Palantir foundry Issues |
|
| References | (MISC) https://palantir.safebase.us/?tcuUid=4cf0b6e6-564a-467b-83ae-36fec3a491c3 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| CPE | cpe:2.3:a:palantir:foundry_issues:*:*:*:*:*:*:*:* | |
| CWE | NVD-CWE-Other |
29 Jun 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-29 19:15
Updated : 2024-02-28 20:13
NVD link : CVE-2023-30946
Mitre link : CVE-2023-30946
CVE.ORG link : CVE-2023-30946
JSON object : View
Products Affected
palantir
- foundry_issues
CWE
NVD-CWE-Other
CWE-288
Authentication Bypass Using an Alternate Path or Channel
CWE-420Unprotected Alternate Channel