mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
46 lines
2.3 KiB
JSON
46 lines
2.3 KiB
JSON
{
|
|
"category": "Vulnerability",
|
|
"channel": "ESCU",
|
|
"creation_date": "2016-09-13",
|
|
"description": "Keeping your Splunk deployment up to date is critical and may help you reduce the risk of CVE-2016-4859, an open-redirection vulnerability within some older versions of Splunk Enterprise. The detection search will help ensure that users are being properly authenticated and not being redirected to malicious domains.",
|
|
"id": "4e692b96-de2d-4bd1-9105-37e2368a8db1",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"modification_date": "2017-09-19",
|
|
"name": "Splunk Enterprise Vulnerability",
|
|
"narrative": "This Analytic Story is associated with CVE-2016-4859, an open-redirect vulnerability in the following versions of Splunk Enterprise:<br></br><ul><li>Splunk Enterprise 6.4.x, prior to 6.4.3</li><li>Splunk Enterprise 6.3.x, prior to 6.3.6</li><li>Splunk Enterprise 6.2.x, prior to 6.2.10</li><li>Splunk Enterprise 6.1.x, prior to 6.1.11</li><li>Splunk Enterprise 6.0.x, prior to 6.0.12</li><li>Splunk Enterprise 5.0.x, prior to 5.0.16</li><li>Splunk Light, prior to 6.4.3</li></ul>CVE-2016-4859 allows attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. (Credit: Noriaki Iwasaki, Cyber Defense Institute, Inc.).<br></br>It is important to ensure that your Splunk deployment is being kept up to date and is properly configured. This detection search allows analysts to monitor internal logs to ensure users are properly authenticated and cannot be redirected to any malicious third-party websites.",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"references": [
|
|
"http://www.splunk.com/view/SP-CAAAPQ6#announce",
|
|
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4859"
|
|
],
|
|
"searches": {
|
|
"contextual_searches": [
|
|
"Get Notable Info",
|
|
"Get Notable History",
|
|
"Get User Information from Identity Table",
|
|
"Get Authentication Logs For Endpoint",
|
|
"Get Risk Modifiers For User",
|
|
"Get Risk Modifiers For Endpoint"
|
|
],
|
|
"detection_searches": [
|
|
"Open Redirect in Splunk Web"
|
|
],
|
|
"investigative_searches": [],
|
|
"support_searches": []
|
|
},
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|