CVE-2022-27888

The Foundry Issues service was found to be logging in a manner that captured session tokens.

View on CVE.org

Published Apr 26, 2022 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in 2.249.1.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Palantir

Foundry Issues

affected

Version	Status	Constraints
`unspecified`	affected	≤ 2.249.0
`next of 2.244.0`	affected	< unspecified

Configuration 1 [-]

cpe:2.3:a:palantir:foundry_issues:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2022-32376	Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in 2.249.1.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.233% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-01.md

History

No history.

Subscriptions

Palantir Foundry Issues

Weaknesses

CWE-532

Sources

CVE record Updated: Sep 17, 2024, 2:27 AM

Status: PUBLISHED
Assigner: Palantir
Published: Apr 26, 2022, 10:35 PM
Updated: Sep 17, 2024, 2:27 AM
Reserved: Mar 25, 2022, 12:00 AM

View source JSON

Vulnrichment No data

No data.

NVD Updated: Jun 17, 2026, 4:37 AM

Status: Modified
Published: Apr 26, 2022, 11:15 PM
Modified: Jun 17, 2026, 4:37 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"containers": {"cna": {"affected": [{"product": "Foundry Issues", "vendor": "Palantir", "versions": [{"lessThanOrEqual": "2.249.0", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "next of 2.244.0", "versionType": "custom"}]}], "datePublic": "2022-03-29T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in 2.249.1."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "description": "CWE-532 Information Exposure Through Log Files", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-27T17:20:08.000Z", "orgId": "bbcbe11d-db20-4bc2-8a6e-c79f87041fd4", "shortName": "Palantir"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-01.md"}], "source": {"defect": ["PLTRSEC-2022-01"], "discovery": "INTERNAL"}, "title": "The Foundry Issues service was found to be logging in a manner that captured session tokens.", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve-coordination@palantir.com", "DATE_PUBLIC": "2022-03-29T21:00:00.000Z", "ID": "CVE-2022-27888", "STATE": "PUBLIC", "TITLE": "The Foundry Issues service was found to be logging in a manner that captured session tokens."}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Foundry Issues", "version": {"version_data": [{"version_affected": "<=", "version_value": "2.249.0"}, {"version_affected": ">", "version_value": "2.244.0"}]}}]}, "vendor_name": "Palantir"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in 2.249.1."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-532 Information Exposure Through Log Files"}]}]}, "references": {"reference_data": [{"name": "https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-01.md", "refsource": "MISC", "url": "https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-01.md"}]}, "source": {"defect": ["PLTRSEC-2022-01"], "discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T05:41:10.540Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-01.md"}]}]}, "cveMetadata": {"assignerOrgId": "bbcbe11d-db20-4bc2-8a6e-c79f87041fd4", "assignerShortName": "Palantir", "cveId": "CVE-2022-27888", "datePublished": "2022-04-26T22:35:08.294Z", "dateReserved": "2022-03-25T00:00:00.000Z", "dateUpdated": "2024-09-17T02:27:08.492Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Foundry Issues", "vendor": "Palantir", "versions": [{"lessThanOrEqual": "2.249.0", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "next of 2.244.0", "versionType": "custom"}]}], "source": "cve-coordination@palantir.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:palantir:foundry_issues:*:*:*:*:*:*:*:*", "matchCriteriaId": "E3A66061-3F6C-4933-A962-D8C704E68760", "versionEndExcluding": "2.249.1", "versionStartIncluding": "2.244.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in 2.249.1."}, {"lang": "es", "value": "Se ha detectado que el servicio Foundry Issues versiones 2.244.0 a 2.249.0, registraba informaci\u00f3n confidencial (tokens de sesi\u00f3n). Este problema ha sido corregido en versi\u00f3n 2.249.1"}], "id": "CVE-2022-27888", "lastModified": "2026-06-17T04:37:41.990", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "cve-coordination@palantir.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-26T23:15:44.533", "references": [{"source": "cve-coordination@palantir.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-01.md"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-01.md"}], "sourceIdentifier": "cve-coordination@palantir.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "cve-coordination@palantir.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-532"}], "source": "nvd@nist.gov", "type": "Primary"}]}