HTTP: Splunk Mappy Search Command Remote Code Execution

This signature detects attempts to exploit a known vulnerability against Splunk. A successful exploit can lead to remote code execution.

Extended Description

Splunk is prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability. An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, disclose or modify sensitive information, or perform unauthorized actions. Other attacks are also possible. Splunk 4.2 to 4.2.4 are vulnerable; other versions may also be affected.

Affected Products

Splunk splunk

References

BugTraq: 51061

CVE: CVE-2011-4642

Short Name

HTTP:MISC:SPLUNK-MAPPY-RCE

Severity

Major

Recommended

True

Recommended Action

Drop

HTTP: Splunk Mappy Search Command Remote Code Execution

Extended Description

Affected Products

References

Found a potential security threat?