Log in Start free

Vulnerability · Published Jun 26, 2023 · Assigned by Palantir

CVE-2023-30945CVE-2023-30945

Critical 9.8

In plain English

A critical-severity improper authentication in com.palantir.gotham:clips2 from Palantir. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.7%top 45.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker could read sensitive files from the filesystem or write/delete arbitrary files on the filesystem as well.

Affected products (as reported)

VendorProductVersions
Palantir com.palantir.gotham:clips2 * – before 0.111.2
Palantir com.palantir.video:video-history-server * – before 2.210.3
Palantir com.palantir.video:video-clip-distributor * – before 0.24.10

Weakness: CWE-287, CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/CR:M

References