Saturday, May 18, 2024

Splunk Patched Critical Vulnerabilities in Enterprise Security

Several vulnerabilities have been discovered in Splunk Enterprise Security and Splunk User Behavior Analytics (UBA), which existed in several third-party packages.

The third-party package includes Splunk, which includes babel/traverse, handsontable, semver, loader-utils, json5, socket.io-parser, protobuf, and Guava.

However, Splunk has acted swiftly upon these vulnerabilities and patched them accordingly. The severity for these vulnerabilities ranges between 7.1 (High) and 9.8 (Critical).

Document
Free Webinar

Fastrack Compliance: The Path to ZERO-Vulnerability

Compounding the problem are zero-day vulnerabilities like the MOVEit SQLi, Zimbra XSS, and 300+ such vulnerabilities that get discovered each month. Delays in fixing these vulnerabilities lead to compliance issues, these delay can be minimized with a unique feature on AppTrana that helps you to get “Zero vulnerability report” within 72 hours.

Technical Analysis

According to the reports shared with Cyber Security News, there were 13 vulnerabilities patched as per Splunk’s security advisories.

protobuf package had the highest number of vulnerabilities at 4 compared to other packages. 

The CVEs were CVE-2015-5237 (8.8), CVE-2022-3171 (7.5), CVE-2022-3509 (7.5), CVE-2022-3510 (7.5). With 3 vulnerabilities, loader-utils became the second package with the highest number of vulnerabilities with one critical vulnerability.

The CVEs of loader-utils package vulnerabilities were CVE-2022-37599 (7.5), CVE-2022-37603 (7.5), and CVE-2022-37601 (9.8).

Other third-party packages like babel/traverse, handsontable, semver, json5, socket.io-parser, and Guava had one high severity vulnerability each. The CVEs were as follows.

  • babel/traverse (CVE-2023-45133 – 8.8)
  • handsontable (CVE-2021-23446 – 7.5)
  • semver (CVE-2022-25883 – 7.5)
  • json5 (CVE-2022-46175 – 8.8)
  • socket.io-parser (CVE-2023-32695 – 7.5)
  • Guava (CVE-2023-2976 – 7.1)

Affected Products and Fixed in Version

ProductVersionComponentAffected VersionFix Version
Splunk Enterprise Security (ES)7.37.3.0
Splunk Enterprise Security (ES)7.27.2.0
Splunk Enterprise Security (ES)7.1Below 7.1.27.1.2
Splunk User Behavior Analytics (UBA)Below 5.3.05.3.0
Splunk User Behavior Analytics (UBA)Below 5.2.15.2.1

It is recommended for users of these products to upgrade to the mentioned versions or higher to prevent these vulnerabilities from getting exploited by threat actors.

Looking for cost-effective penetration testing services? Try Kelltron’s to assess and evaluate the security posture of digital systems – 

Website

Latest articles

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...

Millions Of IoT Devices Vulnerable To Attacks Leads To Full Takeover

Researchers discovered four significant vulnerabilities in the ThroughTek Kalay Platform, which powers 100 million...
Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles