CVE-2023-30969 Vulnerability Details

  /     /     /  

CVE-2023-30969 Metadata Quick Info

CVE Published: 25/10/2023 | CVE Updated: 10/09/2024 | CVE Year: 2023
Source: Palantir | Vendor: Palantir | Product: com.palantir.tiles:tiles
Status : PUBLISHED

---

CVE-2023-30969 Description

The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints.

Metrics

CVSS Version: 3.1 | Base Score: 8.2 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-284
CWE Name: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Source: Palantir

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-115
CAPEC Description: An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.


Source: NVD (National Vulnerability Database).