Intrusion PreventionSplunk.Search.Remote.Code.Execution
Description
This indicates an attack attempt to exploit a Remote Code Execution vulnerability in Splunk.
The vulnerability is due to insufficient sanitizing of user supplied inputs in the application when handling admin requests and requires admin privileges to work. Hence, a remote attacker can couple a Cross Site Request Forgery vulnerability to obtain admin privileges to execute arbitrary code on a vulnerable server.
Affected Products
Splunk 4.2.x prior to version 4.2.5
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
http://www.splunk.com/view/SP-CAAAGMM#RemoteCodeExecutioninSplunkWebSPL45172CVE20114642
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 30724 |
| Created | Jan 21, 2012 |
| Updated | Nov 15, 2021 |
| Risk |
|
| CVE ID | CVE-2011-4642 |
| Exploit Prediction Score | 1.65% |
| Default Action | drop |
| Active | |
| Affected OS | Windows |
| Affected App | Other |