Splunk Enterprise security vulnerabilities

Splunk Enterprise is a suite of data collection and analytics software from Splunk, Inc. in the United States. A security vulnerability exists in Splunk Enterprise versions 9.3.x prior to 9.3.1, 9.2.x prior to 9.2.3, and 9.1.x prior to 9.1.6, which originates from a vulnerability that could expos...

Splunk Enterprise 9.1.0 < 9.1.6, 9.2.0 < 9.2.3, 9.3.0 < 9.3.1 (SVD-2024-1001)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-1001 advisory. - In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the admin o...

Splunk Enterprise 9.1.0 < 9.1.6, 9.2.0 < 9.2.3, 9.3.0 < 9.3.1 (SVD-2024-1006)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-1006 advisory. - In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107,...

Splunk Enterprise 9.1.0 < 9.1.6, 9.2.0 < 9.2.3, 9.3.0 < 9.3.1 (SVD-2024-1008)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-1008 advisory. - In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to th...

Splunk Enterprise 9.1.0 < 9.1.6, 9.2.0 < 9.2.3 (SVD-2024-1003)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-1003 advisory. - In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the admin or power...

Splunk Enterprise 9.1.0 < 9.1.6, 9.2.0 < 9.2.3 (SVD-2024-1011)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-1011 advisory. - In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a...

CVE-2024-45732: Missing Authorization

In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk use...

Splunk Enterprise 9.1.0 < 9.1.6, 9.2.0 < 9.2.3 (SVD-2024-1004)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-1004 advisory. - In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the admin or power Splunk rol...

MAL-2024-9285 Malicious code in splunk-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f3b4cb45a7c61ff4ef92918dc5438c1ae4845121a1c99903638fb56ffdbe8014 The OpenSSF Package Analysis project identified 'splunk-docs' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in splunk-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f3b4cb45a7c61ff4ef92918dc5438c1ae4845121a1c99903638fb56ffdbe8014 The OpenSSF Package Analysis project identified 'splunk-docs' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

Splunk Enterprise Privilege Escalation Command Injection

The vulnerability of Splunk Enterprise’s External Lookups technology relates to the improper elimination of certain elements used in the operating system’s command set. This occurs due to the use of data models for detecting unauthorized searches called SearchActivity. Exploiting this vulnerabili...

Splunk __raw Server Info Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Splunk raw Server Info Disclosure ', 'Description' = %q Splunk 6.2.3 through 7.0.1 allows information disclosure by appending...

Where to find Talos at BlackHat 2024

With Black Hat just a week away, Cisco Talos is gearing up for another year of heading to Las Vegas to share in some of the latest major cybersecurity announcements, research and news. This year marks the 10th anniversary of Cisco Talos, as the Talos brand was officially launched in August 2014 a...

Splunk Config Explorer XSS

The vulnerability of the Splunk Config Explorer software for visualizing and analyzing configuration files exists due to the lack of measures taken to protect the structure of its web interface. Exploiting this vulnerability could allow a malicious actor to carry out XSS attacks remotely...

bigml (>=9.8.0, <=9.8.1), neuroflow-yalab (>=0.1.8, <=0.1.9) +2 more potentially affected by CVE-2024-6345 via setuptools (69.0.0)

setuptools PYPI version 69.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - bigml =9.8.0, =0.1.8, =3.8.1, =3.9.1 Source cves: CVE-2024-6345 Source advisory: OSV:GHSA-CX63-2MW6-8HW5...

SAML Standard Splunk Enterprise Brute Force

The vulnerability of the SAML standard implementation in the Splunk Enterprise platform for operational analysis is related to inconsistencies in responses to incoming requests. Exploiting this vulnerability could allow a malicious actor to carry out a brute-force attack...

Splunk Web XSS

The vulnerability of the Splunk Web interface of the Splunk Enterprise operating analysis platform is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

Splunk Web Upload Data Arbitrary File Write

The vulnerability of the Upload Data module in the Splunk Web interface of the Splunk Enterprise operating analysis platform is related to the unlimited uploading of dangerous types of files. Exploiting this vulnerability allows a malicious actor to upload any type of file...

Splunk Web Bulletin Messages XSS

The vulnerability of the Bulletin Messages module in the Splunk Web interface of the Splunk Enterprise operating analysis platform is related to the lack of protective measures for the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting...

Splunk Web Analytics Workspace Command Injection

The vulnerability of the Analytics Workspace web interface in the Splunk Web platform for operational analysis in Splunk Enterprise is related to insufficient protection of sensitive data. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute arbitrary...