CVE-2022-32154: falha de média gravidade em Splunk Enterprise
Risky commands warnings in Splunk Enterprise Dashboards
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 1.5%
Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) for more information. Note that the attack is browser-based and an attacker cannot exploit it at will.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVEs relacionadas — Splunk Enterprise
No mesmo produto, das mais perigosas para as menos.
CVE-2022-32158CRITICALSplunk Enterprise deployment servers allow client publishing of forwarder bundlesEPSS 1.5%CVE-2022-32157HIGHSplunk Enterprise deployment servers allow unauthenticated forwarder bundle downloadsEPSS 1.4%CVE-2022-32153HIGHSplunk Enterprise lacked TLS host name validationEPSS 0.9%CVE-2022-32151HIGHSplunk Enterprise disabled TLS validation using the CA certificate stores in Python 3 libraries by defaultEPSS 0.8%
Referências
https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commandshttps://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updateshttps://research.splunk.com/application/splunk_command_and_scripting_interpreter_delete_usage/https://research.splunk.com/application/splunk_command_and_scripting_interpreter_risky_commands/https://research.splunk.com/application/splunk_command_and_scripting_interpreter_risky_spl_mltk/https://www.splunk.com/en_us/product-security/announcements/svd-2022-0604.html