mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
41 lines
2.1 KiB
JSON
41 lines
2.1 KiB
JSON
{
|
|
"category": [
|
|
"Vulnerability"
|
|
],
|
|
"channel": "ESCU",
|
|
"creation_date": "2016-09-13",
|
|
"description": "Keeping your Splunk deployment up to date is critical and may help you reduce the risk of CVE-2016-4859, an open-redirection vulnerability within some older versions of Splunk Enterprise. The detection search will help ensure that users are being properly authenticated and not being redirected to malicious domains.",
|
|
"detections": [
|
|
{
|
|
"detection_id": "d199fb99-2312-451a-9daa-e5efa6ed76a7",
|
|
"name": "Open Redirect in Splunk Web",
|
|
"type": "splunk"
|
|
}
|
|
],
|
|
"id": "4e692b96-de2d-4bd1-9105-37e2368a8db1",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"modification_date": "2017-09-19",
|
|
"name": "Splunk Enterprise Vulnerability",
|
|
"narrative": "This Analytic Story is associated with CVE-2016-4859, an open-redirect vulnerability in the following versions of Splunk Enterprise:\\\n\\\n1. Splunk Enterprise 6.4.x, prior to 6.4.3\\\n1. Splunk Enterprise 6.3.x, prior to 6.3.6\\\n1. Splunk Enterprise 6.2.x, prior to 6.2.10\\\n1. Splunk Enterprise 6.1.x, prior to 6.1.11\\\n1. Splunk Enterprise 6.0.x, prior to 6.0.12\\\n1. Splunk Enterprise 5.0.x, prior to 5.0.16\\\n1. Splunk Light, prior to 6.4.3CVE-2016-4859 allows attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. (Credit: Noriaki Iwasaki, Cyber Defense Institute, Inc.).\\\nIt is important to ensure that your Splunk deployment is being kept up to date and is properly configured. This detection search allows analysts to monitor internal logs to ensure users are properly authenticated and cannot be redirected to any malicious third-party websites.",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"references": [
|
|
"http://www.splunk.com/view/SP-CAAAPQ6#announce",
|
|
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4859"
|
|
],
|
|
"spec_version": 2,
|
|
"usecase": "Security Monitoring",
|
|
"version": "1.0"
|
|
}
|