CVE-2023-30956CWE-639

IDOR in Foundry Comments allows retrieval of attachments

Medium · published July 10, 2023

CVSS v3.1
5.3
EPSS
0%
Percentile
38.5
In the wild
Unconfirmed
What it is

A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00455 · 38.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2023-07-10T21:07Z
EPSS history
Timeline
  • 10 JUL 21:07Z
    IDOR in Foundry Comments allows retrieval of attachments
    cvelistv5