CVE-2023-30946

Issues notification metadata lacks authorization

State: Published
Severity: 3.5 Low
Published: Jun 29, 2023
Updated: Oct 28, 2024
Reserved: Apr 21, 2023

Description

A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the RID of the issue, severity, internal UUID of the author, and the user-defined title of the issue.

Scores

CVSS	Score	Vector	Source
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N	Palantir

Weaknesses

CWE-420 The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
CWE-288 A product requires authentication, but the product has an alternate path or channel that does not require authentication.

Affected Products

Product	Versions
com.palantir.issues:issuesPalantir	before 2.497.0Affected

References

https://palantir.safebase.us/?tcuUid=4cf0b6e6-564a-467b-83ae-36fec3a491c3

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.