{"id":"CVE-2023-22834","state":"PUBLISHED","title":"The contour service was not checking that users had permission to create an analysis for a given dataset","description":"The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass folders with extraneous analyses, that the attacker would otherwise not have permission to create.","publishedAt":"2023-06-26T23:06:00.892Z","updatedAt":"2024-11-07T18:29:04.974Z","severity":{"score":2.7,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/AR:L","source":"Palantir"},"assigner":"Palantir","products":["Palantir com.palantir.contour:contour-dispatch"],"affected":[{"vendor":"Palantir","product":"com.palantir.contour:contour-dispatch","versions":[{"version":"*","status":"affected","lessThan":"9.642.0","versionType":"semver"}]}],"references":["https://palantir.safebase.us/?tcuUid=14874400-e9c9-4ac4-a8a6-9f4c48a56ff8"],"weaknesses":["CWE-425"],"ingestedAt":"2026-10-29T20:05:43.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/22xxx/CVE-2023-22834.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-22834","state":"PUBLISHED","datePublished":"2023-06-26T23:06:00.892Z","dateUpdated":"2024-11-07T18:29:04.974Z","assignerShortName":"Palantir","assignerOrgId":"bbcbe11d-db20-4bc2-8a6e-c79f87041fd4","dateReserved":"2023-01-06T21:43:46.848Z"},"containers":{"cna":{"title":"The contour service was not checking that users had permission to create an analysis for a given dataset","descriptions":[{"lang":"en","value":"The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass folders with extraneous analyses, that the attacker would otherwise not have permission to create."}],"affected":[{"vendor":"Palantir","product":"com.palantir.contour:contour-dispatch","versions":[{"version":"*","status":"affected","lessThan":"9.642.0","versionType":"semver"}]}],"references":[{"url":"https://palantir.safebase.us/?tcuUid=14874400-e9c9-4ac4-a8a6-9f4c48a56ff8"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/AR:L","baseSeverity":"LOW","baseScore":2.7},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-425","description":"The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Palantir","orgId":"bbcbe11d-db20-4bc2-8a6e-c79f87041fd4","dateUpdated":"2023-06-26T23:06:00.892Z"},"impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place."}]}],"source":{"discovery":"INTERNAL","defect":["PLTRSEC-2023-09"]}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://palantir.safebase.us/?tcuUid=14874400-e9c9-4ac4-a8a6-9f4c48a56ff8","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T10:20:30.681Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-07T18:28:55.612164Z","id":"CVE-2023-22834","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-07T18:29:04.974Z"}}]}}}