CVE-2022-27889
Assigner: Palantir
Published: 2022-06-09T00:00:00
State: PUBLISHED
affected: product: Foundry Multipass
vendor: Palantir
versions: lessThan: 3.647.0
status: affected
version: unspecified
versionType: custom
credits: value: This issue was identified internally at Palantir. Initial activity was observed as a result of good-faith security research conducted by bug bounty participants.
datePublic: 2022-06-09T00:00:00
descriptions: value: The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A malicious attacker could perform an application-level denial of service attack, potentially causing authentication and/or authorization operations to fail for the duration of the attack. This could lead to performance degradation or login failures for customer Palantir Foundry environments. This vulnerability is resolved in Multipass 3.647.0. This issue affects: Palantir Foundry Multipass versions prior to 3.647.0.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
problemTypes: descriptions: cweId: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
type: CWE
source: advisory: PLTRSEC-2022-02
discovery: USER
title: The Foundry Multipass service contains code paths that could be abused to cause a denial of service for authentication and authorization operations.
x_generator: engine: Vulnogram 0.0.9