Bug in OSV1 Could Allow Unauthorized Access to Restricted Objects
CVE-2024-49581

6.5MEDIUM

Key Information:

Vendor

Palantir

Status
Com.palantir.gotham:external-artifacts
Vendor
CVE Published:
2 December 2024

What is CVE-2024-49581?

Restricted Views backed objects (OSV1) could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have permission to see such objects to view them via Object Explorer directly. This software bug did not impact or otherwise make data available across organizational boundaries nor did it allow for data to be viewed or accessed by unauthenticated users.
The affected service have been patched and automatically deployed to all Apollo-managed Foundry instances.

Affected Version(s)

com.palantir.gotham:external-artifacts * < 105.115.0

References

https://palantir.safebase.us/?tcuUid=b60db1ee-4b1a-475d-8...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.