CVE-2022-32154
Risky commands warnings in Splunk Enterprise Dashboards
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) for more information. Note that the attack is browser-based and an attacker cannot exploit it at will.
Los cuadros de mando en Splunk Enterprise versiones anteriores a 9.0, podrían permitir a un atacante inyectar comandos de búsqueda arriesgados en un token de formulario cuando el token es usado en una consulta en una petición de origen cruzado. El resultado es una omisión de las salvaguardas de SPL para los comandos de riesgo. Véase Las nuevas capacidades pueden limitar el acceso a algunos comandos personalizados y potencialmente arriesgados (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) para más información. Tenga en cuenta que el ataque está basado en el navegador y un atacante no puede explotarlo a voluntad
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-05-31 CVE Reserved
- 2022-06-15 CVE Published
- 2023-11-26 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CAPEC
References (6)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Splunk Search vendor "Splunk" | Splunk Search vendor "Splunk" for product "Splunk" | < 9.0 Search vendor "Splunk" for product "Splunk" and version " < 9.0" | enterprise |
Affected
| ||||||
| Splunk Search vendor "Splunk" | Splunk Cloud Platform Search vendor "Splunk" for product "Splunk Cloud Platform" | < 8.2.2106 Search vendor "Splunk" for product "Splunk Cloud Platform" and version " < 8.2.2106" | - |
Affected
| ||||||