CVE-2022-27897CWE-20
Palantir Gotham included an endpoint that would log arbitrary sized zip files.
Medium · published February 16, 2023
What it is
Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources on the dispatch server.
The record
Technical detail
- CVSS v3.1
- 5.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.00616 · 48.9th percentile
- Weakness
- CWE-20 · Improper Input Validation
- Published
- 2023-02-16T00:00Z
EPSS history
Timeline