The contour service was not checking that users had permission to create an analysis for a given dataset
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.7epss 0.4%
exploitation probability
0.4%top 72% of all CVEs
observed exploitation
nono source reports it
The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass folders with extraneous analyses, that the attacker would otherwise not have permission to create.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/AR:L
Affected products
Palantir · com.palantir.contour:contour-dispatch