CVE-2023-22937

Unnecessary File Extensions Allowed by Lookup Table Uploads in Splunk Enterprise

CVSS 4.3 MEDIUMEPSS 0.4%CWE-20

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table upload feature let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now be one of the following only: .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gzl.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Productos afectados

Splunk · Splunk Cloud Platform Splunk · Splunk Enterprise

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://advisory.splunk.com/advisories/SVD-2023-0207 https://research.splunk.com/application/b7d1293f-e78f-415e-b5f6-443df3480082/