Splunk Enterprise Remote Command Execution Vulnerability via Scripted Inputs

A remote command execution vulnerability has been identified in Splunk Enterprise versions prior to 9.4.3, 9.3.5, 9.2.7, and 9.1.10. This issue arises from improper sanitization of user input in scripted input files, allowing users with roles that include the high-privilege capabilities 'edit_scripted' and 'list_inputs' to execute commands remotely.

Impact

Exploitation of this vulnerability allows for remote command execution on the affected system.

Remediation

Users are advised to upgrade Splunk Enterprise to versions 9.4.3, 9.3.5, 9.2.7, 9.1.10, or higher. If an upgrade is not possible, the high-privilege capability 'edit_scripted' should be removed from the user role.