RCE in Splunk

CVE-2013-7394

The "runshellscript echo.sh" script in Splunk before 5.0.5 allows remote authenticated users to execute arbitrary commands via a crafted string. NOTE: this issue was SPLIT from CVE-2013-6771 per ADT2 due to different vulnerability types.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.021 (79.7th percentile) — read the EPSS interpretation.

Affected products

  • Splunk — versions 5.0, 5.0.1, 5.0.2
  • N/a — versions n/a

Weakness classification (CWE)

References