CVE-2023-30961

Palantir Gotham-Fe-Bundle 100.30230702.0 – 100.30230704.15

Published

27 September 2023

Modified

21 November 2024

Patch / advisory

View advisory

CVSS Score v3.1 6.5

Click a component to see what it means

Raw vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS Score 0.0035 28th percentile

Risk Priority 50 floored blend · peak EPSS

Summary

CVE-2023-30961 is a medium-severity Improper Adherence to Coding Standards (CWE-710) vulnerability in Palantir Gotham-Fe-Bundle. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2023-35299

Vulnerability Data

Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or link.

CWE(s): CWE-710 CWE-1021

Related Threats

MITRE ATT&CK Enterprise Techniques

T1189 Drive-by Compromise Initial Access

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.

attack.mitre.org →

T1056 Input Capture Collection

Adversaries may use methods of capturing user input to obtain credentials or collect information.

attack.mitre.org →

T1557 Adversary-in-the-Middle Credential Access

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.

attack.mitre.org →

Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-30963Same vendor: Palantir

CVE-2023-30959Same vendor: Palantir

CVE-2023-30967Same vendor: Palantir

CVE-2023-30962Same vendor: Palantir

CVE-2023-30945Same vendor: Palantir

CVE-2023-30949Same vendor: Palantir

CVE-2023-30950Same vendor: Palantir

CVE-2026-10733Shared CWE-1021

CVE-2023-20913Shared CWE-1021

CVE-2026-12348Shared CWE-1021

Affected Assets

palantir

gotham-fe-bundle

100.30230702.0 — 100.30230704.15 · 100.30230706.0 — 100.30230706.22

palantir

titanium-browser-app-bundle

≤ 100.30230706.20

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match

prevents

Integrating and monitoring secure SDLC practices directly enforces coding standards adherence while the control also addresses broader lifecycle activities.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.28 Secure coding mostly match

prevents

Directly requires secure coding practices and standards.

A.8.29 Security testing in development and acceptance mostly match

finds

Testing can detect violations but does not prevent them.

A.5.36 Compliance with policies, rules and standards for information security partial match

finds

Enforces adherence to coding standards as part of policy compliance.

A.8.23 Web filtering partial match

degrades

Web filtering can block or sandbox untrusted frames, but does not enforce application-level frame-busting or CSP.