CVSS 8.0 · High EPSS 16,0%
Kerentanan Improper Access Control pada splunk, splunk cloud platform. Skor CVSS 3.1 8.0 (High) menurut cisco.com.
In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) through a file upload to the "$SPLUNK_HOME/var/run/splunk/apptemp" directory due to missing authorization checks.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| splunk | splunk | Versi 9.1.0 hingga sebelum 9.1.8 |
| splunk | splunk | Versi 9.2.0 hingga sebelum 9.2.5 |
| splunk | splunk | Versi 9.3.0 hingga sebelum 9.3.3 |
| splunk | splunk | Versi 9.4.0 |
| splunk | splunk cloud platform | Versi 9.1.2312 hingga sebelum 9.1.2312.208 |
| splunk | splunk cloud platform | Versi 9.2.2403 hingga sebelum 9.2.2403.114 |
| splunk | splunk cloud platform | Versi 9.2.2406.100 hingga sebelum 9.2.2406.108 |
| splunk | splunk cloud platform | Versi 9.3.2408.100 hingga sebelum 9.3.2408.104 |