CVE-2023-30956

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-309586.1A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bCVE-2023-309595.4In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that requirCVE-2023-30967.8A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been declared as critical. This vulnerability affects thCVE-2023-309604.3A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not havCVE-2023-309616.1Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classifiCVE-2023-309625.4The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with accCVE-2023-309635.4A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be CVE-2023-309677.5Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to rCVE-2023-309686.8One of Gotham Gaia services was found to be vulnerable to a stored cross-site scripting (XSS) vulnerability that could have allowed an attacCVE-2023-309696.5The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorizatiCVE-2023-30977.8A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been rated as critical. This issue affects the function CVE-2023-309706.5Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary
CVE-2023-30956: Medium severity, CVSS 5.3 | Vulnix