« Volver al listado

CVE-2013-6771

Estado: ModificadaAlta (9.3)—

Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the file parameter. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2013-7394 is for the issue in the "runshellscript echo.sh" script.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Splunk — Splunk

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-6771",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-08-07T11:13:34.377",
  "references": [
    {
      "url": "http://www.splunk.com/view/SP-CAAAH76",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://zerodayinitiative.com/advisories/ZDI-14-052/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.splunk.com/view/SP-CAAAH76",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://zerodayinitiative.com/advisories/ZDI-14-052/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the file parameter.  NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2013-7394 is for the issue in the \"runshellscript echo.sh\" script."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de salto de directorio en la secuencia de comandos collect en Splunk anterior a 5.0.5 permite a atacantes remotos ejecutar comandos arbitrarios a través de un .. (punto punto) en el parámetro file. NOTA: este problema fue dividido (SPLIT) por ADT2 debido a tipos de vulnerabilidad diferentes. CVE-2013-7394 es para el problema en la secuencia de comandos 'runshellscript echo.sh'."
    }
  ],
  "lastModified": "2026-06-17T00:00:55.257",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B38D97E5-7CE5-41D8-8A86-C4AB3795BA04",
              "versionEndIncluding": "5.0.4"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C505FC5B-E1FB-45F6-8AE9-B6AB85D8B8E2"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:5.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ECD5CA90-779D-4A29-B763-D26F2EDA57E6"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:5.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF23AA2D-DE4A-4E23-A7F1-557668D393BA"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:5.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68651DCE-E568-4929-851F-CC2724E4E8D3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}