CVE-2023-30962

Stored XSS in cerberus attachments

State: Published
Severity: 6.8 Medium
Published: Sep 12, 2023
Updated: Sep 25, 2024
Reserved: Apr 21, 2023

Description

The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to launch attacks against other users. This vulnerability is resolved in Cerberus 100.230704.0-27-g031dd58 .

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N	Palantir

Weaknesses

CWE-434 The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

Affected Products

Product	Versions
com.palantir.acme.cerberus:cerberusPalantir	before 100.230704.0-27-g031dd58Affected

References

https://palantir.safebase.us/?tcuUid=92dd599a-07e2-43a8-956a-9c9566794be0

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.