title: The contour service was not checking that users had permission to create an analysis for a given dataset
description: The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass folders with extraneous analyses, that the attacker would otherwise not have permission to create.
problem types: The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
affected:
{
vendor: Palantir
product: com.palantir.contour:contour-dispatch
versions:
version: *, versionType: semver, lessThan: 9.642.0, status: affected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/AR:L
baseSeverity: LOW
baseScore: 2.7
]
format: CVSS