Medium severity · published Jan 29, 2024
CVE-2023-30970
Gotham table and Forward App Path traversal
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
com.palantir.gotham:blackbird-witchcraft · Palantir
before 104.30231002.10; before 104.30231001.8; before 104.30230807.59; before 104.30230908.21; before 103.30230304.433; before 104.30230604.81; +1 more · source: vendor
GB
Gotham Blackbird-witchcraft · Palantir
10.1 before 104.30231001.8; 10.2 before 104.30231002.10; 10.3 before 104.30231003.9; 9.8 before 104.30230908.21; 8.7 before 104.30230807.59; 6.4 before 104.30230604.81; +1 more · source: NVD
GS
Gotham Static-assets-servlet · Palantir
before 1.1.0 · source: NVD
Affected product
CO
com.palantir.gotham:blackbird-witchcraft
Palantir