CVSS 5.4 · Medium EPSS 0,28%
Kerentanan Improper Access Control pada splunk, splunk cloud platform. Skor CVSS 3.1 5.4 (Medium) menurut cisco.com.
In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create or overwrite [system source type](https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.2/configure-source-types/create-source-types) configurations by sending a specially-crafted payload to the `/servicesNS/nobody/search/admin/sourcetypes/` REST endpoint on the Splunk management port.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| splunk | splunk | Versi 9.1.0 hingga sebelum 9.1.10 |
| splunk | splunk | Versi 9.2.0 hingga sebelum 9.2.7 |
| splunk | splunk | Versi 9.3.0 hingga sebelum 9.3.5 |
| splunk | splunk | Versi 9.4.0 hingga sebelum 9.4.2 |
| splunk | splunk cloud platform | Versi 9.2.2406 hingga sebelum 9.2.2406.119 |
| splunk | splunk cloud platform | Versi 9.3.2408 hingga sebelum 9.3.2408.113 |
| splunk | splunk cloud platform | Versi 9.3.2411 hingga sebelum 9.3.2411.104 |