CVE-2023-30956: IDOR in Foundry Comments allows retrieval of attachments
A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this security defect in Foundry Comments?
The vulnerability ID for this security defect in Foundry Comments is CVE-2023-30956.
What is the severity rating of CVE-2023-30956?
The severity rating of CVE-2023-30956 is medium with a CVSS score of 5.3.
How can the contents of an attachment submitted to another comment be discovered?
The contents of an attachment submitted to another comment can be discovered if the user knows the internal UUID of the target attachment.
Has the security defect in Foundry Comments been fixed?
Yes, the security defect in Foundry Comments has been resolved with the release of Foundry Comments 2.267.0.
Where can I find more information about CVE-2023-30956?
More information about CVE-2023-30956 can be found at [this link](https://palantir.safebase.us/?tcuUid=40367943-738c-4e69-b852-4a503c77478a).