CVE-2013-6771: Path Traversal

Q: What is the severity of CVE-2013-6771?

CVE-2013-6771 is considered a critical vulnerability due to its ability to allow remote attackers to execute arbitrary commands.

Q: How do I fix CVE-2013-6771?

To fix CVE-2013-6771, upgrade your Splunk instance to version 5.0.5 or later.

Q: What systems are affected by CVE-2013-6771?

CVE-2013-6771 affects Splunk versions prior to 5.0.5, including all versions from 5.0 to 5.0.4.

Q: Can CVE-2013-6771 lead to unauthorized access?

Yes, CVE-2013-6771 can lead to unauthorized access as it allows attackers to execute arbitrary commands on the server.

Q: Is there a workaround for CVE-2013-6771?

There is no effective workaround for CVE-2013-6771, and updating to a fixed version is necessary to protect against the vulnerability.

Published Aug 7, 2014

Updated

Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the file parameter. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2013-7394 is for the issue in the "runshellscript echo.sh" script.

Affected Software

5 affected components

Splunk splunk<=5.0.4

Splunk splunk=5.0

Splunk splunk=5.0.1

Splunk splunk=5.0.2

Splunk splunk=5.0.3

Event History

Aug 7, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-6771?

CVE-2013-6771 is considered a critical vulnerability due to its ability to allow remote attackers to execute arbitrary commands.

How do I fix CVE-2013-6771?

To fix CVE-2013-6771, upgrade your Splunk instance to version 5.0.5 or later.

What systems are affected by CVE-2013-6771?