PT-2023-18784 · Splunk · Splunk Enterprise

James Ervin · Publicado 2023-02-14 · Atualizado 2024-04-10 · CVE-2023-22940

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 8.1.13 Splunk Enterprise versions prior to 8.2.10 Splunk Enterprise versions prior to 9.0.4

Description The issue concerns aliases of the collect search processing language (SPL) command, including summaryindex, sumindex, stash, mcollect, and meventcollect, which were not designated as safeguarded commands. This could potentially allow for the exposing of data to a summary index that unprivileged users could access. The issue requires a higher privileged user to initiate a request within their browser and only affects instances with Splunk Web enabled.

Recommendations For versions prior to 8.1.13, update to version 8.1.13 or later. For versions prior to 8.2.10, update to version 8.2.10 or later. For versions prior to 9.0.4, update to version 9.0.4 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-22940

Produtos afetados

Splunk Enterprise

Referências · 5

• https://advisory.splunk.com/advisories/SVD-2023-0210 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-22940 · Aviso do Fabricante
• https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd · Aviso do Fabricante
• https://t.me/cibsecurity/58136 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-22940 · Nota de Segurança