CVE-2023-30963mediumCWE-82

CVE-2023-30963: medium-severity vulnerability in Palantir com.palantir.foundry:foundry-frontend

Stored XSS in Foundry Slate Query Dropdown menu

Published · Updated

Follow this CVE+ Monitor com.palantir.foundry:foundry-frontend

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.4%
A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.229.0. The service was rolled out to all affected Foundry instances. No further intervention is required.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Palantir · com.palantir.foundry:foundry-frontend
Related CVEs — Palantir com.palantir.foundry:foundry-frontend

In the same product, most dangerous first.

CVE-2023-22835HIGHDenial of Service in Foundry IssuesEPSS 0.7%CVE-2023-30952MEDIUMFoundry Issues reporterPath phishing by parameter injectionEPSS 0.4%CVE-2023-30958MEDIUMDOM XSS in Developer mode dashboard via redirect GET parameterEPSS 0.4%