CVSS: 7.7EPSS: 0%CPEs: 2EXPL: 0CVE-2023-22835 – Denial of Service in Foundry Issues
https://notcve.org/view.php?id=CVE-2023-22835
A security defect was identified that enabled a user of Foundry Issues to perform a Denial of Service attack by submitting malformed data in an Issue that caused loss of frontend functionality to all issue participants. This defect was resolved with the release of Foundry Issues 2.510.0 and Foundry Frontend 6.228.0. • https://palantir.safebase.us/?tcuUid=0e2e79bd-cc03-42a8-92c2-c0e68a1ea53d • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-30946 – Issues notification metadata lacks authorization
https://notcve.org/view.php?id=CVE-2023-30946
A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the RID of the issue, severity, internal UUID of the author, and the user-defined title of the issue. • https://palantir.safebase.us/?tcuUid=4cf0b6e6-564a-467b-83ae-36fec3a491c3 • CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE-420: Unprotected Alternate Channel •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-30955 – Foundry workspace-server Developer Mode Authorization Bypass
https://notcve.org/view.php?id=CVE-2023-30955
A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'. This enabled users with insufficient privilege the ability to view and interact with Developer Mode settings in a limited capacity. A fix was deployed with workspace-server 7.7.0. • https://palantir.safebase.us/?tcuUid=0c3f6c33-4eb0-48b5-ab87-fe48c46a4170 • CWE-602: Client-Side Enforcement of Server-Side Security CWE-863: Incorrect Authorization •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22833 – Mandatory control bypass in Lime2
https://notcve.org/view.php?id=CVE-2023-22833
Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users within a Foundry organization to bypass discretionary or mandatory access controls under certain circumstances. • https://palantir.safebase.us/?tcuUid=7f1fd834-805d-4679-85d0-9d779fa064ae • CWE-304: Missing Critical Step in Authentication CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-30948 – Retrieval of Attachments to Comments lacks Authorization
https://notcve.org/view.php?id=CVE-2023-30948
A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks. This could enable an authenticated user to inject a prior discovered attachment UUID into other arbitrary comments to discover it's content. This defect was fixed in Foundry Comments 2.249.0, and a patch was rolled out to affected Foundry environments. No further intervention is required at this time. • https://palantir.safebase.us/?tcuUid=101b083b-6389-4261-98f8-23448e133a62 • CWE-285: Improper Authorization CWE-862: Missing Authorization •