CVE-2023-30968
6.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Summary
One of Gotham Gaia services was found to be vulnerable to a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker to bypass CSP and get a persistent cross site scripting payload on the stack.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Palantir | com.palantir.acme.gaia:gaia | 100.240108.11 < * | unaffected |
| Palantir | com.palantir.acme.gaia:gaia | 100.240203.6 < * | unaffected |
| Palantir | com.palantir.acme.gaia:gaia | 100.230807.13 < * | unaffected |
| Palantir | com.palantir.acme.gaia:gaia | 100.240205.0-12-gf415217 < * | unaffected |
| Palantir | com.palantir.acme.gaia:gaia | 100.231108.82 < * | unaffected |
| Palantir | com.palantir.acme.gaia:gaia | 100.231009.47 < * | unaffected |
| Palantir | com.palantir.acme.gaia:gaia | 100.240202.9 < * | unaffected |
Weaknesses
- CWE-434: The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.
ADP Enrichment
CVE Program Container
Additional References
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.