PT-2012-1938 · Splunk · Splunk

Gary Oleary-Steele · Publicado 2012-01-03 · Atualizado 2012-01-26 · CVE-2011-4644

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Splunk versions 4.2.5 and earlier

Description The issue allows remote attackers to read arbitrary files or execute management commands. This is possible when a Free license is selected, enabling potentially undesirable functionality within an environment that intentionally does not support authentication. Attackers can leverage the ability to create crafted data sources via a management-console session or send an HTTP request to execute management commands.

Recommendations For Splunk versions 4.2.5 and earlier, consider disabling the ability to create crafted data sources and restrict access to management-console sessions to minimize the risk of exploitation. Additionally, limit the execution of management commands via HTTP requests until a fix is available.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2011-4644

Produtos afetados

Splunk

Referências · 6

• 🔥 https://exploit-db.com/exploits/18245 · Exploit
• 🔥 http://sec-1.com/blog/wp-content/uploads/2011/12/Attacking_Splunk_Release.pdf · Exploit
• 🔥 http://exploit-db.com/exploits/18245 · Exploit
• 🔥 http://sec-1.com/blog/?p=233 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4644 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4644 · Nota de Segurança