CVE-2023-22834

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass folders with extraneous analyses, that the attacker would otherwise not have permission to create.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-425CWE-862

Affected software

VendorProductVersions
Palantircom.palantir.contour:contour-dispatch< 9.642.0

References

Timeline

Published
Jun 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-228357.7A security defect was identified that enabled a user of Foundry Issues to perform a Denial of Service attack by submitting malformed data inCVE-2023-228365.4In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes a group name from the default value, thCVE-2023-228385.4Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1,CVE-2023-228397.5On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.xCVE-2023-22844.3The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on theCVE-2023-228405.5Improper neutralization in software for the Intel(R) oneVPL GPU software before version 22.6.5 may allow an authenticated user to potentiallCVE-2023-228417.3Unquoted search path in the software installer for the System Firmware Update Utility (SysFwUpdt) for some Intel(R) Server Boards and Intel(CVE-2023-228427.5On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile isCVE-2023-228434.8An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definitCVE-2023-228449.8An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-craftCVE-2023-228457.5An out-of-bounds read vulnerability exists in the TGAInput::decode_pixel() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specCVE-2023-228465.5Datakit CrossCadWare_x64.dll contains an out-of-bounds read past the end of an allocated buffer while parsing a specially crafted SLDPRT fil
CVE-2023-22834: Medium severity, CVSS 4.3 | Vulnix