Описание
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the admin or power Splunk roles could upload a file with an arbitrary extension using the indexing/preview REST endpoint.
Ссылки
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
4.3 Medium
CVSS3
6.5 Medium
CVSS3
Дефекты
Связанные уязвимости
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the admin or power Splunk roles could upload a file with an arbitrary extension using the indexing/preview REST endpoint.
Уязвимость модуля Upload Data веб-интерфейса Splunk Web платформы для операционного анализа Splunk Enterprise, позволяющая нарушителю записывать произвольные файлы
EPSS
4.3 Medium
CVSS3
6.5 Medium
CVSS3