CVE-2022-48307

It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. In the case of a successful man in the middle attack on magritte-ftp, an attacker would be able to read and modify network traffic such as authentication tokens or raw data entering a Palantir Foundry stack.

• CWE-297
• CWE-295

• https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-13.mdVendor Advisory
• https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-13.mdVendor Advisory

Published

Feb 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-48300The WMS module lacks the authentication mechanism in some AP…7.5
• CVE-2022-48301The bundle management module lacks permission verification i…7.5
• CVE-2022-48302The AMS module has a vulnerability of lacking permission ver…7.5
• CVE-2022-48303GNU Tar through 1.34 has a one-byte out-of-bounds read that …5.5
• CVE-2022-48305There is an identity authentication bypass vulnerability in …5.5
• CVE-2022-48306Improper Validation of Certificate with Host Mismatch vulner…6.8
• CVE-2022-48308It was discovered that the sls-logging was not verifying hos…3.7
• CVE-2022-48309A CSRF vulnerability allows malicious websites to retrieve l…4.3
• CVE-2022-4831The Custom User Profile Fields for User Registration WordPre…5.4
• CVE-2022-48310An information disclosure vulnerability allows sensitive key…5.5
• CVE-2022-48311**UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in …9
• CVE-2022-48312The HwPCAssistant module has the out-of-bounds read/write vu…9.1