CVE-2022-27896

low-risk
Published 2022-11-14

Information Exposure Through Log Files vulnerability discovered in Foundry Code-Workbooks where the endpoint backing that console was generating service log records of any Python code being run. These service logs included the Foundry token that represents the Code-Workbooks Python console. Upgrade to Code-Workbooks version 4.461.0. This issue affects Palantir Foundry Code-Workbooks version 4.144 to version 4.460.0 and is resolved in 4.461.0.

Do I need to act?

-
0.21% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.2/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Foundry Code-Workbooks

Affected Vendors

Palantir

References (2)

Third Party Advisory https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-08.md
Third Party Advisory https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-08.md
21
/ 100
low-risk
Severity 15/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal