Multiple vulnerabilities have been reported in Splunk products, which could allow an unauthenticated or low privileged attacker to create or truncate arbitrary files, perform server-side request forgery (SSRF), execute malicious scripts in a victim¿s browser, disclose sensitive information, bypass access controls, and exfiltrate sensitive data from the targeted system.
Target Audience:
All organizations and individuals using Splunk products.
Risk Assessment:
Critical risk of unauthorized system access, remote code execution, data exfiltration, privilege escalation, information disclosure, and compromise of the confidentiality, integrity, and availability of affected Splunk environments.
Impact Assessment:
Potential for arbitrary file creation and truncation, server-side request forgery, information disclosure, unauthorized ownership reassignment, execution of malicious scripts, and sensitive data exfiltration.
The information provided herein is on "as is" basis, without warranty of any kind.