title: Insecure Direct Object Reference (IDOR) in Foundry job-tracker
description: A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was rolled out to all affected Foundry instances. No further intervention is required.
problem types: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
affected:
{
vendor: Palantir
product: com.palantir.foundry.jobtracker:job-tracker
versions:
version: *, versionType: semver, lessThan: 4.645.0, status: affected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
baseScore: 4.3
]
format: CVSS