Lucene search

PalantirCVE-2023-30945

HistoryJun 26, 2023 - 11:15 p.m.

CVE-2023-30945

2023-06-2623:15:09

CWE-287

CWE-22

Palantir

web.nvd.nist.gov

cve-2023-30945

vhs

vcd

clips2

vulnerability

unauthenticated

file read

file write

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

52.4%

JSON

Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker could read sensitive files from the filesystem or write/delete arbitrary files on the filesystem as well.

Affected configurations

Nvd

Node

palantirclips2Range<0.111.2

palantirvideo_clip_distributorRange<0.24.10

palantirvideo_history_serviceRange<2.210.3

VendorProductVersionCPE
palantirclips2*cpe:2.3:a:palantir:clips2:*:*:*:*:*:*:*:*
palantirvideo_clip_distributor*cpe:2.3:a:palantir:video_clip_distributor:*:*:*:*:*:*:*:*
palantirvideo_history_service*cpe:2.3:a:palantir:video_history_service:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
palantir	clips2	*	cpe:2.3:a:palantir:clips2::::::::
palantir	video_clip_distributor	*	cpe:2.3:a:palantir:video_clip_distributor::::::::
palantir	video_history_service	*	cpe:2.3:a:palantir:video_history_service::::::::

CNA Affected

[
  {
    "vendor": "Palantir",
    "product": "com.palantir.gotham:clips2",
    "versions": [
      {
        "version": "*",
        "versionType": "semver",
        "lessThan": "0.111.2",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Palantir",
    "product": "com.palantir.video:video-history-server",
    "versions": [
      {
        "version": "*",
        "versionType": "semver",
        "lessThan": "2.210.3",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Palantir",
    "product": "com.palantir.video:video-clip-distributor",
    "versions": [
      {
        "version": "*",
        "versionType": "semver",
        "lessThan": "0.24.10",
        "status": "affected"
      }
    ]
  }
]

References

palantir.safebase.us/?tcuUid=e62e4dad-b39b-48ba-ba30-7b7c83406ad9

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

52.4%

JSON

Related for CVE-2023-30945