Test ID:	1.3.6.1.4.1.25623.1.0.106472
Category:	Web application abuses
Title:	Splunk Enterprise SSRF Vulnerability (SP-CAAAPSR)
Summary:	Splunk Enterprise is prone to a server-side request forgery; (SSRF) vulnerability.
Description:	Summary: Splunk Enterprise is prone to a server-side request forgery (SSRF) vulnerability. Vulnerability Insight: A server-side request forgery (SSRF) vulnerability exists in the Splunk Enterprise web management interface within the Alert functionality. The application parses user supplied data in the GET parameter 'alerts_id' to construct a HTTP request to the splunkd daemon. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make a HTTP request to an arbitrary destination host. Vulnerability Impact: An attacker may exploit this via social engineering or other vectors to exfiltrate administrative authentication tokens for the Splunk REST API to an external domain. Affected Software/OS: Splunk Enterprise 6.4.x, 6.3.x, 6.2.x, 6.1.x, 6.0.x and 5.0.x. Solution: Update to version 6.4.4, 6.3.8, 6.2.12, 6.1.12, 6.0.13, 5.0.17 or later. CVSS Score: 9.0 CVSS Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.