CVE-2023-30946CWE-288CWE-420
Issues notification metadata lacks authorization
Low · published June 29, 2023
What it is
A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the RID of the issue, severity, internal UUID of the author, and the user-defined title of the issue.
The record
Technical detail
- CVSS v3.1
- 3.5 · LOW
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00393 · 32.3th percentile
- Weaknesses
- CWE-288 · Authentication Bypass Using an Alternate Path or Channel; CWE-420 · Unprotected Alternate Channel
- Published
- 2023-06-29T18:49Z
EPSS history
Timeline