CVE-2023-30945 CVE-2023-30945
Unauthenticated attackers can read, write, or delete arbitrary files on Palantir video services due to missing input validation on filenames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-30945?
CVE-2023-30945 is a critical path traversal vulnerability in com.palantir.gotham:clips2, published on 26 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker could read sensitive files from the filesystem or write/delete arbitrary files on the filesystem as well.
Which versions are affected by CVE-2023-30945?
It affects 3 products.
Products include Palantir Clips2, Palantir Video Clip Distributor, Palantir Video History Service.
How do I fix CVE-2023-30945?
No fix has been published for CVE-2023-30945 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-30945 being exploited?
There is no known exploitation of CVE-2023-30945 in the wild and no public exploit code.
Sources
Also known as GHSA-rvq3-c9mq-763g.