CVE-2023-30956
IDOR in Foundry Comments allows retrieval of attachments
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 10, 2023
- Updated
- Oct 23, 2024
- Reserved
- Apr 21, 2023
Description
A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N | Palantir |
Weaknesses
- CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Affected Products
| Product | Versions |
|---|---|
com.palantir.comments:commentsPalantir |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.