CVE-2023-30946

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the RID of the issue, severity, internal UUID of the author, and the user-defined title of the issue.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-288 CWE-420

Affected software

No affected versions have been published.

Timeline

Published: Jun 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-309486.5A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional aut CVE-2023-309495.3A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishi CVE-2023-30956.5Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-309505.9The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint CVE-2023-309516.5The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack (XXE).CVE-2023-309524.3A security defect was discovered in Foundry Issues that enabled users to create convincing phishing links by editing the request sent when c CVE-2023-309543.7The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the sour CVE-2023-309555.4A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related CVE-2023-309565.3A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comm CVE-2023-309586.1A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be b CVE-2023-309595.4In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that requir CVE-2023-30967.8A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been declared as critical. This vulnerability affects th