Bug in OSV1 Could Allow Unauthorized Access to Restricted Objects
CVE-2024-49581
6.5MEDIUM
Key Information
- Vendor
- Palantir
- Status
- Com.palantir.gotham:external-artifacts
- Vendor
- CVE Published:
- 2 December 2024
Summary
Restricted Views backed objects (OSV1) could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have permission to see such objects to view them via Object Explorer directly. This software bug did not impact or otherwise make data available across organizational boundaries nor did it allow for data to be viewed or accessed by unauthenticated users. The affected service have been patched and automatically deployed to all Apollo-managed Foundry instances.
Affected Version(s)
com.palantir.gotham:external-artifacts < 105.115.0
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published.
Vulnerability Reserved.
Collectors
NVD DatabaseMitre Database