Description
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Splunk / Splunk Cloud9.0.2305.200
- Splunk / Splunk Enterprise8.2 – 8.2.12
- Splunk / Splunk Enterprise9.0 – 9.0.6
- Splunk / Splunk Enterprise9.1 – 9.1.1
Updated 53m ago · 2 sources