CVE-2023-30952

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A security defect was discovered in Foundry Issues that enabled users to create convincing phishing links by editing the request sent when creating an Issue. This defect was resolved in Frontend release 6.228.0 .

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Palantir	com.palantir.foundry:foundry-frontend	—

References

https://palantir.safebase.us/?tcuUid=42bdb7fa-9a6d-4462-b89d-cabc62f281f4Vendor Advisory
https://palantir.safebase.us/?tcuUid=42bdb7fa-9a6d-4462-b89d-cabc62f281f4Vendor Advisory

Timeline

Published: Aug 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-309543.7The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the sour CVE-2023-309555.4A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related CVE-2023-309565.3A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comm CVE-2023-309586.1A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be b CVE-2023-309595.4In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that requir CVE-2023-30967.8A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been declared as critical. This vulnerability affects th CVE-2023-309604.3A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not hav CVE-2023-309616.1Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classifi CVE-2023-309625.4The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with acc CVE-2023-309635.4A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be CVE-2023-309677.5Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to r CVE-2023-309686.8One of Gotham Gaia services was found to be vulnerable to a stored cross-site scripting (XSS) vulnerability that could have allowed an attac