Splunk Enterprise and SOAR flaws expose data and bypass controls
INCIBE-CERT reported on October 22 that three Splunk security bulletins cover 17 critical- and high-severity vulnerabilities across Splunk Enterprise and Splunk SOAR: four critical and 13 high. The advisories describe possible sensitive-information exposure and ways to bypass authentication, authorization, or other security restrictions; some attacks may not require authentication.
The four listed CVEs span both products: Enterprise has access-control and input-neutralization flaws, while SOAR has an access-control flaw and an issue involving files or directories accessible to third parties. In plain terms, the defects can expose information or let an attacker cross a security boundary, so the risk is not confined to one product or flaw type.
Fixed releases differ by branch: Enterprise 10.4.4, 10.2.8, 10.0.11, or 9.4.16, and SOAR 8.7.0. For organizations running both, one product’s update status says nothing about the other; Enterprise 9.4.x also lacks the PostgreSQL service affected by some component flaws.
Splunk ha rilasciato aggiornamenti di sicurezza per sanare molteplici vulnerabilità, di cui 4 con gravità “critica” e 13 con gravità “alta”, nei prodotti Splunk SOAR e Splunk Enterprise.