Skip to content
CVE PROGRAM SOURCE RECORD4.1 Medium

CVE-2023-30959

Stored XSS via javascript URI in Apollo Change Requests comment

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Palantir

Description

In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palantir com.palantir.apollo:autopilot

  • * to < 3.308.0affected

References