Skip to content
OpenAdvisories
Low · 2.7 CVE-2023-22834 EUVD-2023-26945GHSA-83vf-mjcw-6wh8

The contour service was not checking that users had permission to create an analysis for a given dataset

Published Jun 26, 2023 · Updated Nov 7, 2024 · Assigned by Palantir

Description

The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass folders with extraneous analyses, that the attacker would otherwise not have permission to create.

Affected products

VendorProductAffectedFixed
Palantir com.palantir.contour:contour-dispatch < 9.642.0 9.642.0

References