CVE-2011-4642

mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote authenticated administrators to execute arbitrary code by leveraging the sys module in a request to the search application, as demonstrated by a cross-site request forgery (CSRF) attack, aka SPL-45172.

CVSS v2.0

4.6 MEDIUMAV:N/AC:H/Au:S/C:P/I:P/A:P

EPSS

28.62% chance of exploitation in the next 30 days, 98th percentile

Published

2012-01-03

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/18245/

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/splunk_mappy_exec.rb

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/18245

References

• CVE Record
• NVD entry

Related

• CVE-2011-4640
• CVE-2011-4643
• CVE-2011-4624
• CVE-2011-4644
• CVE-2011-4620
• CVE-2011-4670