| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| splunk | ≥ 8.1.0, < 8.1.13≥ 8.2.0, < 8.2.10≥ 9.0.0, < 9.0.4 | 8.1.138.2.109.0.4 |
| splunk cloud platform | < 9.0.2209.3 | 9.0.2209.3 |
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled.
これらの製品をお使いですか?サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン