CVE-2025-62487

{"id": "CVE-2025-62487", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve-coordination@palantir.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "published": "2026-01-09T22:16:00.260", "references": [{"url": "https://palantir.safebase.us/?tcuUid=c91a1b4f-72e7-4959-9e2d-3a341e5c7a1f", "source": "cve-coordination@palantir.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@palantir.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels. The regression was traced back to a change in May 2025, which was meant to allow file uploads to be shared among different artifacts (e.g. other dossiers and presentations).\n\n\nOn deployments configured with CBAC, the front-end would present a security picker dialog to set the security level on the uploads, thereby mitigating the issue.\n\n\nOn deployments without a CBAC configuration, no security picker dialog appears, leading to a security level of CUSTOM with no markings or datasets selected. The resulting markings and groups for the file uploads thus will be only those added by the default authorization rules defined in the Auth Chooser configuration. On most environments, it is expected that the default authorization rules only add the Everyone group."}, {"lang": "es", "value": "El 1 de octubre de 2025, Palantir descubri\u00f3 que las im\u00e1genes subidas a trav\u00e9s de la aplicaci\u00f3n de interfaz (front-end) de Dossier no estaban siendo marcadas correctamente con los niveles de seguridad adecuados. La regresi\u00f3n se rastre\u00f3 hasta un cambio en mayo de 2025, que ten\u00eda como objetivo permitir que las subidas de archivos se compartieran entre diferentes artefactos (por ejemplo, otros dosieres y presentaciones).\n\nEn despliegues configurados con CBAC, la interfaz (front-end) presentar\u00eda un di\u00e1logo de selecci\u00f3n de seguridad para establecer el nivel de seguridad en las subidas, mitigando as\u00ed el problema.\n\nEn despliegues sin una configuraci\u00f3n de CBAC, no aparece ning\u00fan di\u00e1logo de selecci\u00f3n de seguridad, lo que lleva a un nivel de seguridad de CUSTOM sin marcas ni conjuntos de datos seleccionados. Las marcas y grupos resultantes para las subidas de archivos, por lo tanto, ser\u00e1n solo aquellos a\u00f1adidos por las reglas de autorizaci\u00f3n predeterminadas definidas en la configuraci\u00f3n de Auth Chooser. En la mayor\u00eda de los entornos, se espera que las reglas de autorizaci\u00f3n predeterminadas solo a\u00f1adan el grupo Todos."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "cve-coordination@palantir.com"}