CVE-2022-27891mediumCWE-200

CVE-2022-27891: falha de média gravidade em Palantir Gotham

Palantir Gotham included an unauthenticated endpoint that listed all active usernames in the platform with an active session.

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Gotham

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.4%
Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances. It is highly recommended that customers upgrade all affected services to the latest version. This issue affects: Palantir Gotham versions prior to 103.30221005.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Palantir · Gotham
CVEs relacionadas — Palantir Gotham

No mesmo produto, das mais perigosas para as menos.

CVE-2022-27892MEDIUMPalantir Gotham included an endpoint that would log arbitrary sized payloads. EPSS 0.6%CVE-2022-27897MEDIUMPalantir Gotham included an endpoint that would log arbitrary sized zip files. EPSS 0.6%