QID 379050

Splunk software helps capture, index and correlate real-time data in a searchable repository, from which it can generate graphs, reports, alerts, dashboards and visualizations.

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise.

Affected Versions:
Splunk Enterprise versions from 9.0.0 prior to 9.0.7
Splunk Enterprise versions from 9.1.0 prior to 9.1.2

QID Detection Logic:

QID Detection Logic(Authenticated)
Linux: Checks for installed vulnerable version of Splunk Enterprise from "/etc/splunk.version" file either in "/opt/splunk" directory or using "$SPLUNK_HOME" environment variable.
Windows: Checks for installed vulnerable version of Splunk from "/etc/splunk.version" file using registry "HKLM\SYSTEM\CurrentControlSet\Services\Splunkd".

Successful exploitation of this vulnerability may allow an attacker to upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance