Vulnerability · Published Jul 10, 2023 · Assigned by Palantir
CVE-2023-30963Stored XSS in Foundry Slate Query Dropdown menu
Medium 5.4
In plain English
A medium-severity security flaw in com.palantir.foundry:foundry-frontend from Palantir. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.4%top 67.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.229.0. The service was rolled out to all affected Foundry instances. No further intervention is required.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palantir | com.palantir.foundry:foundry-frontend | * – before 6.229.0 |
Weakness: CWE-82 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N