CVE-2023-30952 Foundry Issues reporterPath phishing by parameter injection
Attackers can create phishing links by injecting parameters into issue creation requests, potentially tricking users into visiting malicious sites.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-30952?
CVE-2023-30952 is a medium-severity vulnerability in com.palantir.foundry:foundry-frontend, published on 3 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A security defect was discovered in Foundry Issues that enabled users to create convincing phishing links by editing the request sent when creating an Issue. This defect was resolved in Frontend release 6.228.0 .
Weakness: CWE-20
Which versions are affected by CVE-2023-30952?
It affects 1 product.
Products include Palantir Foundry.
How do I fix CVE-2023-30952?
No fix has been published for CVE-2023-30952 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-30952 being exploited?
There is no known exploitation of CVE-2023-30952 in the wild and no public exploit code.
Other vulnerabilities in com.palantir.foundry:foundry-frontend
Sources
Also known as GHSA-f7vf-674j-p83m.