by Kastro
Paper/Archive/CVE-2023-30945

CVE-2023-30945

Palantir com.palantir.gotham:clips2 — CVE-2023-30945

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.1.541 × 2010.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker could read sensitive files from the filesystem or write/delete arbitrary files on the filesystem as well.

Affected

ProductAffectedFixed inSource
com.palantir.gotham:clips2< 0.111.20.111.2CNA
com.palantir.video:video-history-server< 2.210.32.210.3CNA
com.palantir.video:video-clip-distributor< 0.24.100.24.10CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Palantir (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/CR:M
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refpalantir.safebase.us/?tcuUid=e62e4dad-b39b-48ba-ba30-7b7c83406ad9