PT-2023-12923 · Palantir · Palantir Gotham

Publicado 2023-02-16 · Atualizado 2023-02-24 · CVE-2022-27897

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Palantir Gotham versions prior to 3.22.11.2

Description The issue concerns an unauthenticated endpoint that loads portions of maliciously crafted zip files to memory. An attacker could exploit this by repeatedly uploading a malicious zip file, allowing them to exhaust memory resources on the dispatch server.

Recommendations For Palantir Gotham versions prior to 3.22.11.2, update to version 3.22.11.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the unauthenticated endpoint to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2022-27897

Produtos afetados

Palantir Gotham

Referências · 4

• https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-12.md · Aviso do Fabricante
• https://t.me/cibsecurity/58329 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-27897 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-27897 · Nota de Segurança