Vulnerability · Published Aug 3, 2023 · Assigned by Palantir
CVE-2023-30958DOM XSS in Developer mode dashboard via redirect GET parameter
Medium 4.7
In plain English
A medium-severity security flaw in com.palantir.foundry:foundry-frontend from Palantir. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.4%top 65.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.225.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palantir | com.palantir.foundry:foundry-frontend | * – before 6.225.0 |
Weakness: CWE-83 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N