by Kastro
Paper/Archive/CVE-2022-27889

CVE-2022-27889

Palantir Foundry Multipass — The Foundry Multipass service contains code paths that could be abused to cause a denial of service for authentication and authorization operations.

EPSS 1.0%CVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 61.9.619 × 2012.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A malicious attacker could perform an application-level denial of service attack, potentially causing authentication and/or authorization operations to fail for the duration of the attack. This could lead to performance degradation or login failures for customer Palantir Foundry environments. This vulnerability is resolved in Multipass 3.647.0. This issue affects: Palantir Foundry Multipass versions prior to 3.647.0.

Affected

ProductAffectedFixed inSource
Foundry Multipassunspecified – < 3.647.03.647.0CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Palantir (CNA)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

refgithub.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-02.md