PT-2018-10552 · Splunk · Splunk

Kof2002 · Published 2018-06-08 · Updated 2018-07-31 · CVE-2018-11409

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Splunk versions prior to 7.0.1

Description The issue allows information disclosure by appending "/api/v1/server/info/server-info?output mode=json" to a query. This can be used to discover sensitive information, such as a license key.

Recommendations For versions prior to 7.0.1, consider restricting access to the "/api/v1/server/info/server-info" endpoint to minimize the risk of exploitation. Avoid using the output mode parameter with the value json in the affected API endpoint until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-11409

Affected Products

Splunk

References · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/splunk_raw_server_info.rb · Exploit
• 🔥 https://github.com/kofa2002/splunk · Exploit
• 🔥 https://exploit-db.com/exploits/44865 · Exploit
• https://osv.dev/vulnerability/CVE-2018-11409 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11409 · Security Note
• http://securitytracker.com/id/1041148 · Note