{"id":"CVE-2023-30969","state":"PUBLISHED","title":"Palantir Tiles missing authentication on API endpoints","description":"The Palantir Tiles1 service was  found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints.\n\n","publishedAt":"2023-10-25T23:16:06.131Z","updatedAt":"2024-09-10T16:40:49.878Z","severity":{"score":8.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","source":"Palantir"},"assigner":"Palantir","products":["Palantir com.palantir.tiles:tiles"],"affected":[{"vendor":"Palantir","product":"com.palantir.tiles:tiles","versions":[{"version":"*","status":"affected","lessThan":"4.326.0","versionType":"semver"}]}],"references":["https://palantir.safebase.us/?tcuUid=afcbc9b2-de62-44b9-b28b-2ebf0684fbf7"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:05:52.290Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/30xxx/CVE-2023-30969.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-30969","state":"PUBLISHED","datePublished":"2023-10-25T23:16:06.131Z","dateUpdated":"2024-09-10T16:40:49.878Z","assignerShortName":"Palantir","assignerOrgId":"bbcbe11d-db20-4bc2-8a6e-c79f87041fd4","dateReserved":"2023-04-21T11:42:33.501Z"},"containers":{"cna":{"title":"Palantir Tiles missing authentication on API endpoints","descriptions":[{"lang":"en","value":"The Palantir Tiles1 service was  found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints.\n\n"}],"affected":[{"vendor":"Palantir","product":"com.palantir.tiles:tiles","versions":[{"version":"*","status":"affected","lessThan":"4.326.0","versionType":"semver"}]}],"references":[{"url":"https://palantir.safebase.us/?tcuUid=afcbc9b2-de62-44b9-b28b-2ebf0684fbf7"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","baseSeverity":"HIGH","baseScore":8.2},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","description":"The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Palantir","orgId":"bbcbe11d-db20-4bc2-8a6e-c79f87041fd4","dateUpdated":"2023-10-25T23:16:06.131Z"},"impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place."}]}],"source":{"discovery":"INTERNAL","defect":["PLTRSEC-2023-35"]}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://palantir.safebase.us/?tcuUid=afcbc9b2-de62-44b9-b28b-2ebf0684fbf7","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T14:45:24.260Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-10T16:40:33.249053Z","id":"CVE-2023-30969","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-10T16:40:49.878Z"}}]}}}