CVSS 6.8 · Medium EPSS 0,53%
Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada splunk. Skor CVSS 3.1 6.8 (Medium) menurut cisco.com.
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a user who holds a role that contains the high-privilege capability `edit_scripted` and `list_inputs` capability , could perform a remote command execution due to improper user input sanitization on the scripted input files.<br><br>See [Define roles on the Splunk platform with capabilities](https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities) and [Setting up a scripted input ](https://docs.splunk.com/Documentation/Splunk/9.4.2/AdvancedDev/ScriptSetup)for more information.
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| splunk | splunk | Versi 9.1.0 hingga sebelum 9.1.10 |
| splunk | splunk | Versi 9.2.0 hingga sebelum 9.2.7 |
| splunk | splunk | Versi 9.3.0 hingga sebelum 9.3.5 |
| splunk | splunk | Versi 9.4.0 hingga sebelum 9.4.3 |