Description
In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Splunk Splunk Enterprise
8.2 to < 8.2.12affected9.0 to < 9.0.6affected9.1 to < 9.1.1affected
Splunk Splunk Cloud
- to < 9.0.2305.200affected