Lucene search

PalantirCVELIST:CVE-2023-30945

HistoryJun 26, 2023 - 11:00 p.m.

CVE-2023-30945 CVE-2023-30945

2023-06-2623:00:08

CWE-287

CWE-22

Palantir

www.cve.org

multiple services

vhs

video history server

vcd

video clip distributor

clips2

vulnerable

unauthenticated

file read

file write

input validation

filename

sensitive files

filesystem

malicious attacker

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/CR:M

AI Score

9.8

Confidence

High

EPSS

0.002

Percentile

52.4%

JSON

Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker could read sensitive files from the filesystem or write/delete arbitrary files on the filesystem as well.

CNA Affected

[
  {
    "vendor": "Palantir",
    "product": "com.palantir.gotham:clips2",
    "versions": [
      {
        "version": "*",
        "versionType": "semver",
        "lessThan": "0.111.2",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Palantir",
    "product": "com.palantir.video:video-history-server",
    "versions": [
      {
        "version": "*",
        "versionType": "semver",
        "lessThan": "2.210.3",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Palantir",
    "product": "com.palantir.video:video-clip-distributor",
    "versions": [
      {
        "version": "*",
        "versionType": "semver",
        "lessThan": "0.24.10",
        "status": "affected"
      }
    ]
  }
]

References

palantir.safebase.us/?tcuUid=e62e4dad-b39b-48ba-ba30-7b7c83406ad9

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/CR:M

AI Score

9.8

Confidence

High

EPSS

0.002

Percentile

52.4%

JSON

Related for CVELIST:CVE-2023-30945