CVE-2022-27897mediumCWE-20

CVE-2022-27897: falha de média gravidade em Palantir Gotham

Palantir Gotham included an endpoint that would log arbitrary sized zip files.

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Gotham

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.6%
Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources on the dispatch server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
Palantir · Gotham
CVEs relacionadas — Palantir Gotham

No mesmo produto, das mais perigosas para as menos.

CVE-2022-27892MEDIUMPalantir Gotham included an endpoint that would log arbitrary sized payloads. EPSS 0.6%CVE-2022-27891MEDIUMPalantir Gotham included an unauthenticated endpoint that listed all active usernames in the platform with an active session. EPSS 0.4%