CVE-2023-30958
DOM XSS in Developer mode dashboard via redirect GET parameter
- State
- Published
- Severity
- 4.7 Medium
- Published
- Aug 3, 2023
- Updated
- Oct 9, 2024
- Reserved
- Apr 21, 2023
Description
A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed.
This defect was resolved with the release of Foundry Frontend 6.225.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.7 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N | Palantir |
Weaknesses
- CWE-83 The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
Affected Products
| Product | Versions |
|---|---|
com.palantir.foundry:foundry-frontendPalantir |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.