PT-2018-18065 · Splunk · Splunk Enterprise+1

Publicado

2018-10-23

·

Atualizado

2019-01-25

·

CVE-2018-7431

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 6.0.x through 6.0.13 Splunk Enterprise versions 6.1.x through 6.1.12 Splunk Enterprise versions 6.2.x through 6.2.13 Splunk Enterprise versions 6.3.x through 6.3.9 Splunk Enterprise versions 6.4.x through 6.4.5 Splunk Enterprise versions 6.5.x through 6.5.2 Splunk Light versions prior to 6.6.0
Description A directory traversal issue in the Splunk Django App allows remote authenticated users to read arbitrary files.
Recommendations For Splunk Enterprise versions 6.0.x through 6.0.13, update to version 6.0.14 or later. For Splunk Enterprise versions 6.1.x through 6.1.12, update to version 6.1.13 or later. For Splunk Enterprise versions 6.2.x through 6.2.13, update to version 6.2.14 or later. For Splunk Enterprise versions 6.3.x through 6.3.9, update to version 6.3.10 or later. For Splunk Enterprise versions 6.4.x through 6.4.5, update to version 6.4.6 or later. For Splunk Enterprise versions 6.5.x through 6.5.2, update to version 6.5.3 or later. For Splunk Light versions prior to 6.6.0, update to version 6.6.0 or later.

Correção

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-7431

Produtos afetados

Splunk Enterprise
Splunk Light