Bug in OSV1 Could Allow Unauthorized Access to Restricted Objects

CVE-2024-49581
6.5MEDIUM

Key Information

Vendor
Palantir
Status
Com.palantir.gotham:external-artifacts
Vendor
CVE Published:
2 December 2024

Summary

Restricted Views backed objects (OSV1) could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have permission to see such objects to view them via Object Explorer directly. This software bug did not impact or otherwise make data available across organizational boundaries nor did it allow for data to be viewed or accessed by unauthenticated users. The affected service have been patched and automatically deployed to all Apollo-managed Foundry instances.

Affected Version(s)

com.palantir.gotham:external-artifacts < 105.115.0

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database
.