CVSS 5.4 · Medium EPSS 0,29%
Kerentanan Server-Side Request Forgery (SSRF) pada splunk, splunk secure gateway. Skor CVSS 3.1 5.4 (Medium) menurut cisco.com.
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use Server-Side Request Forgery (SSRF) in report notifications to send system-authenticated requests to internal Splunk services, which could allow for changes to Search Head Cluster state and a denial of service. The vulnerability is possible because Splunk Secure Gateway does not validate report notification path values before it sends internal requests.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| splunk | splunk | Versi 9.4.0 hingga sebelum 9.4.14 |
| splunk | splunk | Versi 10.0.0 hingga sebelum 10.0.9 |
| splunk | splunk | Versi 10.2.0 hingga sebelum 10.2.6 |
| splunk | splunk | Versi 10.4.0 hingga sebelum 10.4.2 |
| splunk | splunk secure gateway | Versi 3.8.0 hingga sebelum 3.8.70 |
| splunk | splunk secure gateway | Versi 3.9.0 hingga sebelum 3.9.23 |
| splunk | splunk secure gateway | Versi 3.10.0 hingga sebelum 3.10.9 |