CVE-2023-22833 Vulnerability Details

  /     /     /  

CVE-2023-22833 Metadata Quick Info

CVE Published: 06/06/2023 | CVE Updated: 02/08/2024 | CVE Year: 2023
Source: Palantir | Vendor: Palantir | Product: com.palantir.lime:lime2
Status : PUBLISHED

---

CVE-2023-22833 Description

Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users within a Foundry organization to bypass discretionary or mandatory access controls under certain circumstances.

Metrics

CVSS Version: 3.1 | Base Score: 7.6 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-304
CWE Name: The product implements an authentication technique, but it skips a step that weakens the technique.
Source: Palantir

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-36
CAPEC Description: An adversary searches for and invokes interfaces or functionality that the target system designers did not intend to be publicly available. If interfaces fail to authenticate requests, the attacker may be able to invoke functionality they are not authorized for.


Source: NVD (National Vulnerability Database).