Skip to content
OpenAdvisories
Medium · 4.3 CVE-2023-30960 EUVD-2023-35298GHSA-w365-qpc6-8w95

Insecure Direct Object Reference (IDOR) in Foundry job-tracker

Published Jul 10, 2023 · Updated Oct 23, 2024 · Assigned by Palantir

Description

A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was rolled out to all affected Foundry instances. No further intervention is required.

Affected products

VendorProductAffectedFixed
Palantir com.palantir.foundry.jobtracker:job-tracker < 4.645.0 4.645.0

References