Stored XSS in cerberus attachments
CVE-2023-30962

5.4MEDIUM

Key Information:

Vendor

Palantir

Status
com.palantir.acme.cerberus:cerberus
Vendor
CVE Published:
12 September 2023

What is CVE-2023-30962?

The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to launch attacks against other users. This vulnerability is resolved in Cerberus 100.230704.0-27-g031dd58 .

Affected Version(s)

com.palantir.acme.cerberus:cerberus * < 100.230704.0-27-g031dd58

References

https://palantir.safebase.us/?tcuUid=92dd599a-07e2-43a8-9...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.