What it is about

Splunk Enterprise ermöglicht Monitoring und Analyse von Clickstream-Daten und Kundentransaktionen. Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben, Daten zu manipulieren, Code auszuführen, einen Denial-of-Service-Zustand zu verursachen und weitere, nicht spezifizierte Auswirkungen zu verursachen.

Under what conditions?

The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.

What can happen in the worst case

An attacker could use the vulnerability to

• Sicherheitsmaßnahmen zu umgehen
• vertrauliche Informationen preiszugeben
• Daten zu manipulieren
• Code auszuführen
• einen Denial-of-Service-Zustand zu verursachen
• weitere
• nicht spezifizierte Auswirkungen zu verursachen

Am I affected?

Affected according to the BSI:

• IBM SPSS Modeler
• Splunk Splunk Enterprise <9.4.0
• Splunk Splunk Enterprise <9.3.3
• Splunk Splunk Enterprise <9.2.5
• Splunk Splunk Enterprise <9.1.8
• Splunk Splunk Enterprise <9.4.1
• Splunk Splunk Enterprise SplunkApp Lookup File Editing <4.0.5
• Splunk Splunk Enterprise SplunkApp Data Science and Deep Learning <5.2.0
• Splunk Splunk Enterprise Spunk DB Connect <4.0.0
• Splunk Splunk Enterprise Splunk Add-on Microsoft Cloud <5.4.3
• Splunk Splunk Enterprise Splunk Infrastructure Monitoring Add-on <1.2.7
• Splunk Splunk Enterprise <9.4.2

and 9 more

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• Splunk Splunk Enterprise 9.4.0
• Splunk Splunk Enterprise 9.3.3
• Splunk Splunk Enterprise 9.2.5
• Splunk Splunk Enterprise 9.1.8
• Splunk Splunk Enterprise 9.4.1
• Splunk Splunk Enterprise SplunkApp Lookup File Editing 4.0.5
• Splunk Splunk Enterprise SplunkApp Data Science and Deep Learning 5.2.0
• Splunk Splunk Enterprise Spunk DB Connect 4.0.0
• Splunk Splunk Enterprise Splunk Add-on Microsoft Cloud 5.4.3
• Splunk Splunk Enterprise Splunk Infrastructure Monitoring Add-on 1.2.7
• Splunk Splunk Enterprise 9.4.2
• Splunk Splunk Enterprise 9.3.4

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.