PT-2023-4797 · Splunk · Splunk Enterprise

Danylo Dmytriiev

+1

·

Publicado

2023-08-16

·

Atualizado

2024-04-10

·

CVE-2023-40595

CVSS v2.0

10

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 8.2.12 Splunk Enterprise versions prior to 9.0.6 Splunk Enterprise versions prior to 9.1.1
Description The issue is related to a deserialization mechanism flaw in the Splunk Web interface of Splunk Enterprise, allowing an attacker to execute arbitrary code by sending a specially crafted query. This can be used to serialize untrusted data, leading to code execution. Approximately 12,000 vulnerable public instances have been found.
Recommendations For versions prior to 8.2.12, update to version 8.2.12 or later. For versions prior to 9.0.6, update to version 9.0.6 or later. For versions prior to 9.1.1, update to version 9.1.1 or later.

Correção

Deserialization of Untrusted Data

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

BDU:2023-05248
CVE-2023-40595

Produtos afetados

Splunk Enterprise