CVE-2011-4642: CSRF
Published Jan 3, 2012
·Updated
mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote authenticated administrators to execute arbitrary code by leveraging the sys module in a request to the search application, as demonstrated by a cross-site request forgery (CSRF) attack, aka SPL-45172.
Affected Software
5 affected components
Splunk splunk=4.2.3
Splunk splunk=4.2.2
Splunk splunk=4.2
Splunk splunk=4.2.4
Splunk splunk=4.2.1
Event History
Jan 3, 2012
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-4642?
CVE-2011-4642 has a high severity due to the potential for remote code execution.
2
How do I fix CVE-2011-4642?
To fix CVE-2011-4642, upgrade Splunk to version 4.2.5 or later.
3
What applications are affected by CVE-2011-4642?
CVE-2011-4642 affects Splunk versions 4.2.0 to 4.2.4.
4
Who can exploit CVE-2011-4642?
Remote authenticated administrators can exploit CVE-2011-4642 to execute arbitrary code.
5
What component of Splunk is vulnerable in CVE-2011-4642?
The vulnerability in CVE-2011-4642 is found in the mappy.py component of Splunk Web.