Vulnerabilities

TI-2022-10777 CVE-2022-27897 · GHSA-fcgx-8f7g-hw7g

Palantir Gotham included an endpoint that would log arbitrary sized zip files.

MEDIUM 40

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00616 Published 2023-02-16 Fixed in 3.22.11.2 CWE-20

TI-2022-10772 CVE-2022-27892 · GHSA-vvv3-m835-966v

Palantir Gotham included an endpoint that would log arbitrary sized payloads.

MEDIUM 40

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00616 Published 2023-02-16 Fixed in 3.22.11.2 CWE-20

TI-2022-10771 CVE-2022-27891 · GHSA-c6x9-mqg2-mmfv

Information disclosure in Palantir Gotham

LOW 30

Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00427 Published 2023-02-16 Fixed in 3.22.10.4 CWE-200

Vulnerabilities

Filters

Palantir Gotham included an endpoint that would log arbitrary sized zip files.

Palantir Gotham included an endpoint that would log arbitrary sized payloads.

Information disclosure in Palantir Gotham