Описание
In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance.
The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation.
Ссылки
- Vendor Advisory
Уязвимые конфигурации
EPSS
9.1 Critical
CVSS3
Дефекты
Связанные уязвимости
In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation.
Уязвимость инструмента btool Configuration Helper программного средства для работы с алгоритмами машинного обучения Splunk AI Tookit (AITK) (ранее Splunk Machine Learning Toolkit (MLTK)), позволяющая нарушителю выполнить произвольные команды
EPSS
9.1 Critical
CVSS3