Vulnerability · Published Jun 14, 2022 · Assigned by Palantir
CVE-2022-27889The Foundry Multipass service contains code paths that could be abused to cause a denial of service for authentication and authorization operations.
Medium 5.3
In plain English
A medium-severity uncontrolled resource consumption in Foundry Multipass from Palantir. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Official description
The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A malicious attacker could perform an application-level denial of service attack, potentially causing authentication and/or authorization operations to fail for the duration of the attack. This could lead to performance degradation or login failures for customer Palantir Foundry environments. This vulnerability is resolved in Multipass 3.647.0. This issue affects: Palantir Foundry Multipass versions prior to 3.647.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palantir | Foundry Multipass | unspecified – before 3.647.0 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L