جزئیات آسیب‌پذیری
CVE-2026-76314
Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise
شرح رسمی (انگلیسی)
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution (RCE) by submitting crafted Splunk Web Manager Configuration content. The user could then access all relevant data and affect system integrity and availability. The vulnerability is possible because Splunk Web evaluates manager Extensible Markup Language expressions without sufficient input restrictions, and the associated configuration route does not require the capability expected for manager configuration changes. For more information see About configuration files (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.4/administer-splunk-enterprise-with-configuration-files/about-configuration-files) in the Splunk documentation.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 8.8بالا | 3.1 | CVEProject cvelistV5 (CNA) (cisco) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Splunk | Splunk Enterprise | 10.0 ≤ v < 10.0.9 | CVEProject cvelistV5 (CNA) |
| Splunk | Splunk Enterprise | 10.2 ≤ v < 10.2.6 | CVEProject cvelistV5 (CNA) |
| Splunk | Splunk Enterprise | 10.4 ≤ v < 10.4.2 | CVEProject cvelistV5 (CNA) |
| Splunk | Splunk Enterprise | 9.4 ≤ v < 9.4.14 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۵/۲۹
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۰۵
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- cisco
پیش‌بینی بهره‌برداری (EPSS)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-94The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.