PT-2023-23091 · Unknown · Gotham Cerberus

Published 2023-09-12 · Updated 2023-09-15 · CVE-2023-30962

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gotham Cerberus versions prior to 100.230704.0-27-g031dd58

Description The Gotham Cerberus service has a stored cross-site scripting (XSS) issue that could allow an attacker with access to Gotham to launch attacks against other users.

Recommendations For versions prior to 100.230704.0-27-g031dd58, update to version 100.230704.0-27-g031dd58 to resolve the issue.

Fix

Unrestricted File Upload

XSS

Weakness Enumeration

CWE-434

CWE-79

Related Identifiers

CVE-2023-30962

Affected Products

Gotham Cerberus

References · 5

• https://palantir.safebase.us/?tcuUid=92dd599a-07e2-43a8-956a-9c9566794be0 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-30962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30962 · Security Note
• https://twitter.com/CVEnew/status/1701666656316186773 · Twitter Post
• https://t.me/cibsecurity/70339 · Telegram Post