cnvd - cnvd-2016-06745

cnvd-2016-06745

Vulnerability from cnvd

Title: Splunk Web开放重定向漏洞

Description:

Splunk是美国Splunk公司的一套数据收集分析软件。该软件主要用于收集、索引和分析机器产生的数据，包括所有IT系统和基础结构（物理、虚拟和云）生成的数据。Splunk Web是其中的一个提供了以Web方式的图形操作界面。

Splunk Web中存在开放重定向漏洞。攻击者可通过构造恶意的URL利用该漏洞诱使用户打开链接，重定向用户到攻击者控制的网站，实施钓鱼攻击。

Severity: 中

Patch Name: Splunk Web开放重定向漏洞

Patch Description:

Splunk Web中存在开放重定向漏洞。攻击者可通过构造恶意的URL利用该漏洞诱使用户打开链接，重定向用户到攻击者控制的网站，实施钓鱼攻击。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://www.splunk.com/view/SP-CAAAPQ6

Reference: http://www.securityfocus.com/bid/92603

Impacted products

Name
['Splunk Enterprise 6.4.x<6.4.3', 'Splunk Enterprise 6.3.x<6.3.6', 'Splunk Enterprise 6.2.x<6.2.10', 'Splunk Enterprise 6.1.x <6.1.11', 'Splunk Enterprise 6.0.x<6.0.12', 'Splunk Enterprise 5.0.x<5.0.16', 'Splunk Light <6.4.3']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "92603"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-4859"
    }
  },
  "description": "Splunk\u662f\u7f8e\u56fdSplunk\u516c\u53f8\u7684\u4e00\u5957\u6570\u636e\u6536\u96c6\u5206\u6790\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u4e3b\u8981\u7528\u4e8e\u6536\u96c6\u3001\u7d22\u5f15\u548c\u5206\u6790\u673a\u5668\u4ea7\u751f\u7684\u6570\u636e\uff0c\u5305\u62ec\u6240\u6709IT\u7cfb\u7edf\u548c\u57fa\u7840\u7ed3\u6784\uff08\u7269\u7406\u3001\u865a\u62df\u548c\u4e91\uff09\u751f\u6210\u7684\u6570\u636e\u3002Splunk Web\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u63d0\u4f9b\u4e86\u4ee5Web\u65b9\u5f0f\u7684\u56fe\u5f62\u64cd\u4f5c\u754c\u9762\u3002\r\n\r\nSplunk Web\u4e2d\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u6784\u9020\u6076\u610f\u7684URL\u5229\u7528\u8be5\u6f0f\u6d1e\u8bf1\u4f7f\u7528\u6237\u6253\u5f00\u94fe\u63a5\uff0c\u91cd\u5b9a\u5411\u7528\u6237\u5230\u653b\u51fb\u8005\u63a7\u5236\u7684\u7f51\u7ad9\uff0c\u5b9e\u65bd\u9493\u9c7c\u653b\u51fb\u3002",
  "discovererName": "Noriaki Iwasaki (Cyber Defense Institute, Inc.)",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a \r\nhttp://www.splunk.com/view/SP-CAAAPQ6",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-06745",
  "openTime": "2016-08-26",
  "patchDescription": "Splunk\u662f\u7f8e\u56fdSplunk\u516c\u53f8\u7684\u4e00\u5957\u6570\u636e\u6536\u96c6\u5206\u6790\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u4e3b\u8981\u7528\u4e8e\u6536\u96c6\u3001\u7d22\u5f15\u548c\u5206\u6790\u673a\u5668\u4ea7\u751f\u7684\u6570\u636e\uff0c\u5305\u62ec\u6240\u6709IT\u7cfb\u7edf\u548c\u57fa\u7840\u7ed3\u6784\uff08\u7269\u7406\u3001\u865a\u62df\u548c\u4e91\uff09\u751f\u6210\u7684\u6570\u636e\u3002Splunk Web\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u63d0\u4f9b\u4e86\u4ee5Web\u65b9\u5f0f\u7684\u56fe\u5f62\u64cd\u4f5c\u754c\u9762\u3002\r\n\r\nSplunk Web\u4e2d\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u6784\u9020\u6076\u610f\u7684URL\u5229\u7528\u8be5\u6f0f\u6d1e\u8bf1\u4f7f\u7528\u6237\u6253\u5f00\u94fe\u63a5\uff0c\u91cd\u5b9a\u5411\u7528\u6237\u5230\u653b\u51fb\u8005\u63a7\u5236\u7684\u7f51\u7ad9\uff0c\u5b9e\u65bd\u9493\u9c7c\u653b\u51fb\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Splunk Web\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e",
  "products": {
    "product": [
      "Splunk Enterprise 6.4.x\u003c6.4.3",
      "Splunk Enterprise 6.3.x\u003c6.3.6",
      "Splunk Enterprise 6.2.x\u003c6.2.10",
      "Splunk Enterprise 6.1.x \u003c6.1.11",
      "Splunk Enterprise 6.0.x\u003c6.0.12",
      "Splunk Enterprise 5.0.x\u003c5.0.16",
      "Splunk Light \u003c6.4.3"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/92603",
  "serverity": "\u4e2d",
  "submitTime": "2016-08-25",
  "title": "Splunk Web\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e"
}

CVE-2016-4859 (GCVE-0-2016-4859)

Vulnerability from cvelistv5

Published

2017-05-12 18:00

Modified

2024-08-06 00:46

Severity ?

CWE

Open Redirect

Summary

Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.3 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

References

▼	URL	Tags
	https://jvn.jp/en/jp/JVN64800312/index.html	third-party-advisory, x_refsource_JVN
	https://www.splunk.com/view/SP-CAAAPQ6	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/92603	vdb-entry, x_refsource_BID

Impacted products

Vendor

Product

Version

▼

Splunk Inc.

Splunk Enterprise

Version: 6.4.x prior to 6.4.3
Version: 6.3.x prior to 6.3.6
Version: 6.2.x prior to 6.2.10
Version: 6.1.x prior to 6.1.11
Version: 6.0.x prior to 6.0.12
Version: 5.0.x prior to 5.0.16

Splunk Inc.

Splunk Light

Version: prior to 6.4.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T00:46:38.464Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "JVN#64800312",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN64800312/index.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.splunk.com/view/SP-CAAAPQ6"
          },
          {
            "name": "92603",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/92603"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "6.4.x prior to 6.4.3"
            },
            {
              "status": "affected",
              "version": "6.3.x prior to 6.3.6"
            },
            {
              "status": "affected",
              "version": "6.2.x prior to 6.2.10"
            },
            {
              "status": "affected",
              "version": "6.1.x prior to 6.1.11"
            },
            {
              "status": "affected",
              "version": "6.0.x prior to 6.0.12"
            },
            {
              "status": "affected",
              "version": "5.0.x prior to 5.0.16"
            }
          ]
        },
        {
          "product": "Splunk Light",
          "vendor": "Splunk Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 6.4.3"
            }
          ]
        }
      ],
      "datePublic": "2016-08-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.3 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Open Redirect",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-05-15T09:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "name": "JVN#64800312",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN64800312/index.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.splunk.com/view/SP-CAAAPQ6"
        },
        {
          "name": "92603",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/92603"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2016-4859",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Splunk Enterprise",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.4.x prior to 6.4.3"
                          },
                          {
                            "version_value": "6.3.x prior to 6.3.6"
                          },
                          {
                            "version_value": "6.2.x prior to 6.2.10"
                          },
                          {
                            "version_value": "6.1.x prior to 6.1.11"
                          },
                          {
                            "version_value": "6.0.x prior to 6.0.12"
                          },
                          {
                            "version_value": "5.0.x prior to 5.0.16"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Splunk Light",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "prior to 6.4.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Splunk Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.3 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Open Redirect"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "JVN#64800312",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN64800312/index.html"
            },
            {
              "name": "https://www.splunk.com/view/SP-CAAAPQ6",
              "refsource": "CONFIRM",
              "url": "https://www.splunk.com/view/SP-CAAAPQ6"
            },
            {
              "name": "92603",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/92603"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2016-4859",
    "datePublished": "2017-05-12T18:00:00",
    "dateReserved": "2016-05-17T00:00:00",
    "dateUpdated": "2024-08-06T00:46:38.464Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted