CVE-2022-27889

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A malicious attacker could perform an application-level denial of service attack, potentially causing authentication and/or authorization operations to fail for the duration of the attack. This could lead to performance degradation or login failures for customer Palantir Foundry environments. This vulnerability is resolved in Multipass 3.647.0. This issue affects: Palantir Foundry Multipass versions prior to 3.647.0.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-400 CWE-913

Affected software

No affected versions have been published.

Timeline

Published: Jun 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-27895.5Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of Data Authenticity, a CVE-2022-278907.4It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory CVE-2022-278915.3Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected serv CVE-2022-278927.5Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory o CVE-2022-278934.2The Foundry Magritte plugin osisoft-pi-web-connector versions 0.15.0 - 0.43.0 was found to be logging in a manner that captured authenticati CVE-2022-278945.4The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to CVE-2022-278957.5Information Exposure Through Log Files vulnerability discovered in Foundry when logs were captured using an underlying library known as Buil CVE-2022-278967.5Information Exposure Through Log Files vulnerability discovered in Foundry Code-Workbooks where the endpoint backing that console was genera CVE-2022-278977.5Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files t CVE-2022-27905.9Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature,CVE-2022-279038.8An OS Command Injection vulnerability in the configuration parser of Eve-NG Professional through 4.0.1-65 and Eve-NG Community through 2.0.3 CVE-2022-279047.0Automox Agent for macOS before version 39 was vulnerable to a time-of-check/time-of-use (TOCTOU) race-condition attack during the agent inst