Skip to content
OpenAdvisories
High WID-SEC-2022-1950 13 CVEs

Splunk Enterprise: Mehrere Schwachstellen

Published Nov 2, 2022 · Updated Dec 27, 2022 · Revision 3 · de-DE

Vendor: Splunk Product: Enterprise Product: Splunk Enterprise < 8.1.12 Product: Splunk Enterprise < 8.2.9 Product: Splunk Enterprise < 9.0.2 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Splunk Enterprise ausnutzen, um Code zur Ausführung zu bringen, Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Daten zu manipulieren oder einen Denial of Service zu verursachen. Zur Ausnutzung einiger Schwachstellen ist eine Interaktion des Opfers notwendig.

Product

Splunk Enterprise ermöglicht Monitoring und Analyse von Clickstream-Daten und Kundentransaktionen.

Vulnerabilities 13

  • High 8.8
    CVE-2022-43567

    Remote Code Execution via the Splunk Secure Gateway application Mobile Alerts feature

    In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system commands remotely through the use of specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app.

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2022-43568 EPSS 43%

    Reflected Cross-Site Scripting via the radio template in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a View allows for a Reflected Cross Site Scripting via JavaScript Object Notation (JSON) in a query parameter when output_mode=radio.

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2022-43570

    XML External Entity Injection through a custom View in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injection via a custom View. The XXE injection causes Splunk Web to embed incorrect documents into an err…

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2022-43571 Public exploit EPSS 19%

    Remote Code Execution through dashboard PDF generation component in Splunk Enterprise

    In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.

    Splunk Splunk Enterprise
  • High 8.1
    CVE-2022-43563

    Risky command safeguards bypass via rex search command field names in Splunk Enterprise

    In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the rex search command handles field names lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulne…

    Splunk Splunk Enterprise
  • High 8.1
    CVE-2022-43565

    Risky command safeguards bypass via ‘tstats command JSON in Splunk Enterprise

    In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the ‘tstats command handles Javascript Object Notation (JSON) lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsaf…

    Splunk Splunk Enterprise
  • High 8.0
    CVE-2022-43569

    Persistent Cross-Site Scripting via a Data Model object name in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can inject and store arbitrary scripts that can lead to persistent cross-site scripting (XSS) in the object name of a Data Model.

    Splunk Splunk Enterprise
  • High 7.5
    CVE-2020-36518 Public exploit

    Deeply nested json in jackson-databind

    jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

    management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2022-43572

    Indexing blockage via malformed data sent through S2S or HEC protocols in Splunk Enterprise

    In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk (S2S) or HTTP Event Collector (HEC) protocols to an indexer results in a blockage or denial-of-service preventing further indexing.

    Splunk Splunk Enterprise
  • High 7.3
    CVE-2022-43566

    Risky command safeguards bypass via Search ID query in Analytics Workspace in Splunk Enterprise

    In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more privileged user’s permissions to bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security…

    Splunk Splunk Enterprise
  • Medium 6.4
    CVE-2022-43561

    Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts that can lead to persistent cross-site scripting (XSS). The vulnerability affects instances with Splunk Web enabled.

    Splunk Splunk Enterprise
  • Medium 4.9
    CVE-2022-43564

    Denial of Service in Splunk Enterprise through search macros

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user who can create search macros and schedule search reports can cause a denial of service through the use of specially crafted search macros.

    Splunk Splunk Enterprise
  • Low 3.0
    CVE-2022-43562

    Host Header Injection in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote authenticated user conduct various attacks against the system, including cross-site scripting and c…

    Splunk Splunk Enterprise

Revision history

  1. #3

    PoC für CVE-2022-43571 aufgenommen

  2. #2

    Schreibfehler korrigiert

  3. #1

    Initiale Fassung

References