CVE-2023-30958mediumCWE-83

CVE-2023-30958: medium-severity vulnerability in Palantir com.palantir.foundry:foundry-frontend

DOM XSS in Developer mode dashboard via redirect GET parameter

Published · Updated

Follow this CVE+ Monitor com.palantir.foundry:foundry-frontend

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.7epss 0.4%
A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.225.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Affected products
Palantir · com.palantir.foundry:foundry-frontend
Related CVEs — Palantir com.palantir.foundry:foundry-frontend

In the same product, most dangerous first.

CVE-2023-22835HIGHDenial of Service in Foundry IssuesEPSS 0.7%CVE-2023-30952MEDIUMFoundry Issues reporterPath phishing by parameter injectionEPSS 0.4%CVE-2023-30963MEDIUMStored XSS in Foundry Slate Query Dropdown menuEPSS 0.4%