Medium severity · published Aug 3, 2023
CVE-2023-30958
DOM XSS in Developer mode dashboard via redirect GET parameter
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed.
This defect was resolved with the release of Foundry Frontend 6.225.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
com.palantir.foundry:foundry-frontend · Palantir
before 6.225.0 · source: vendor
FR
Frontend · Zabbix
before 6.225.0 · source: NVD
Affected product
CO
com.palantir.foundry:foundry-frontend
Palantir
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-30958
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-30958
Vendor Advisory
https://palantir.safebase.us/?tcuUid=5764b094-d3c0-4380-90f2-234f36116c9b
More from com.palantir.foundry:foundry-frontend
7.7
CVE-2023-22835
Denial of Service in Foundry Issues
5.4
CVE-2023-30963
Stored XSS in Foundry Slate Query Dropdown menu