PT-2023-18786 · Splunk · Splunk Enterprise

Anton + 1 · Publicado 2023-02-14 · Atualizado 2024-04-10 · CVE-2023-22942

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 8.1.13 Splunk Enterprise versions prior to 8.2.10 Splunk Enterprise versions prior to 9.0.4

Description A cross-site request forgery in the Splunk Secure Gateway (SSG) app in the 'kvstore client' REST endpoint allows a potential attacker to update SSG KV store collections using an HTTP GET request. The vulnerability affects instances with SSG and Splunk Web enabled.

Recommendations For versions prior to 8.1.13, update to version 8.1.13 or later. For versions prior to 8.2.10, update to version 8.2.10 or later. For versions prior to 9.0.4, update to version 9.0.4 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-22942

Produtos afetados

Splunk Enterprise

Referências · 7

• https://osv.dev/vulnerability/CVE-2023-22942 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-22942 · Nota de Segurança
• https://t.me/cibsecurity/58135 · Publicação no Telegram
• https://t.me/cvenotify/44835 · Publicação no Telegram
• https://advisory.splunk.com/advisories/SVD-2023-0212 · Aviso do Fabricante
• https://t.me/cvenotify/71758 · Publicação no Telegram
• https://research.splunk.com/application/4742d5f7-ce00-45ce-9c79-5e98b43b4410 · Aviso do Fabricante