CVE-2023-30956

Published Jul 10, 2023

Last updated 3 months ago

CVSS medium 5.3

Overview

Description: A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.
Source: cve-coordination@palantir.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.3
Impact score: 3.6
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

cve-coordination@palantir.com: CWE-639
nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:palantir:foundry_comments:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DB9F014E-F469-456C-A77B-46146A38DC42",
            "versionEndExcluding": "2.267.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References