CVE-2023-32303

Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in version 2.0.1. As a workaround, set the secret file permissions to only user read/write by hand.

• CWE-732

• https://github.com/planetlabs/planet-client-python/commit/d71415a83119c5e89d7b80d5f940d162376ee3b7Patch
• https://github.com/planetlabs/planet-client-python/releases/tag/2.0.1Release Notes
• https://github.com/planetlabs/planet-client-python/security/advisories/GHSA-j5fj-rfh6-qj85Patch, Vendor Advisory
• https://github.com/planetlabs/planet-client-python/commit/d71415a83119c5e89d7b80d5f940d162376ee3b7Patch
• https://github.com/planetlabs/planet-client-python/releases/tag/2.0.1Release Notes
• https://github.com/planetlabs/planet-client-python/security/advisories/GHSA-j5fj-rfh6-qj85Patch, Vendor Advisory

Published

May 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32298Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2023-32299Missing Authorization vulnerability in Anzar Ahmed Ni WooCom…6.5
• CVE-2023-3230Missing Authorization in GitHub repository fossbilling/fossb…7.5
• CVE-2023-32300Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2023-32301Discourse is an open source discussion platform. Prior to ve…5.3
• CVE-2023-32302Rejected reason: Authoritative user requested CVE rejection …
• CVE-2023-32305aiven-extras is a PostgreSQL extension. Versions prior to 1.…8.8
• CVE-2023-32306Time Tracker is an open source time tracking system. A time-…9.8
• CVE-2023-32307Sofia-SIP is an open-source SIP User-Agent library, complian…7.5
• CVE-2023-32308anuko timetracker is an open source time tracking system. Bo…9.8
• CVE-2023-32309PyMdown Extensions is a set of extensions for the `Python-Ma…7.5
• CVE-2023-3231A vulnerability has been found in UJCMS up to 6.0.2 and clas…6.5