CVE-2023-22834
27.06.2023, 00:15
The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass folders with extraneous analyses, that the attacker would otherwise not have permission to create.
| Vendor | Product | Version |
|---|---|---|
| palantir | contour | 𝑥 < 9.642.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-425 - Direct Request ('Forced Browsing')The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
- CWE-862 - Missing AuthorizationThe software does not perform an authorization check when an actor attempts to access a resource or perform an action.