CVE-2023-22834CWE-425

The contour service was not checking that users had permission to create an analysis for a given dataset

Low · published June 26, 2023

CVSS v3.1
2.7
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass folders with extraneous analyses, that the attacker would otherwise not have permission to create.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/AR:L
CVSS v4.0
Not supplied
EPSS
0.00350 · 27.4th percentile
Weakness
CWE-425 · Direct Request ('Forced Browsing')
Published
2023-06-26T23:06Z
EPSS history
Timeline
  • 26 JUN 23:06Z
    The contour service was not checking that users had permission to create an analysis for a given dataset
    cvelistv5