CVE-2023-30945
CVE-2023-30945

9.8CRITICAL

Key Information:

Vendor

Palantir

Status
Com.palantir.gotham:clips2
Com.palantir.video:video-history-server
Com.palantir.video:video-clip-distributor
Vendor
CVE Published:
26 June 2023

What is CVE-2023-30945?

Multiple services, including VHS (Video History Server), VCD (Video Clip Distributor), and Clips2, have been identified as vulnerable due to a lack of proper input validation on filenames. This flaw enables a malicious actor to gain unauthorized access to sensitive files on the filesystem. Through this vulnerability, an attacker could potentially read, write, or delete arbitrary files, posing a significant risk to the integrity and confidentiality of data stored within these systems.

Affected Version(s)

com.palantir.gotham:clips2 * < 0.111.2

com.palantir.video:video-clip-distributor * < 0.24.10

com.palantir.video:video-history-server * < 2.210.3

References

https://palantir.safebase.us/?tcuUid=e62e4dad-b39b-48ba-b...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.