CVE-2011-4642

Splunk Web in Splunk 4.2.x before 4.2.5 is vulnerable in the mappy command, which can allow remote authenticated administrators to execute arbitrary code by abusing the sys module in a request to the search application (CSRF scenario). The issue is triggered through the mappy usage in Splunk Web,...

CVE-2011-4642

mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote authenticated administrators to execute arbitrary code by leveraging the sys module in a request to the search application, as demonstrated by a...