What is CVE-2023-30956?

CVE-2023-30956 is a medium-severity vulnerability in Palantir Com.palantir.comments:comments, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 5.3/10. Published 2023-07-10.

How severe is CVE-2023-30956?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Auth bypass in Palantir Com.palantir.comments:comments

CVE-2023-30956

A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.005 (37.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

cve-coordination@palantir.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-30956?: CVE-2023-30956 is a medium-severity vulnerability in Palantir Com.palantir.comments:comments, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 5.3/10. Published 2023-07-10.
How severe is CVE-2023-30956?: Medium severity. CVSS v3 base score is 5.3 out of 10.