The contour service was not checking that users had permission to create an analysis for a given dataset
CVE-2023-22834

2.7LOW

Key Information:

Vendor

Palantir

Status
Com.palantir.contour:contour-dispatch
Vendor
CVE Published:
27 June 2023

What is CVE-2023-22834?

The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass folders with extraneous analyses, that the attacker would otherwise not have permission to create.

Affected Version(s)

com.palantir.contour:contour-dispatch * < 9.642.0

References

https://palantir.safebase.us/?tcuUid=14874400-e9c9-4ac4-a...

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.