CVE-2011-4642

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 28.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-01-03 · updated 2026-06-16
Weakness: CWE-352

Description

mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote authenticated administrators to execute arbitrary code by leveraging the sys module in a request to the search application, as demonstrated by a cross-site request forgery (CSRF) attack, aka SPL-45172.

Affected products

Splunk Enterprise: 4.2, 4.2.1, 4.2.2, 4.2.3, 4.2.4

References

http://secunia.com/advisories/47232
http://www.exploit-db.com/exploits/18245/
http://www.sec-1.com/blog/?p=233
http://www.sec-1.com/blog/wp-content/uploads/2011/12/Attacking_Splunk_Release.pdf
http://www.securitytracker.com/id?1026451
http://www.splunk.com/view/SP-CAAAGMM
http://secunia.com/advisories/47232
http://www.exploit-db.com/exploits/18245/
http://www.sec-1.com/blog/?p=233
http://www.sec-1.com/blog/wp-content/uploads/2011/12/Attacking_Splunk_Release.pdf
http://www.securitytracker.com/id?1026451
http://www.splunk.com/view/SP-CAAAGMM

Get alerted when CVE-2011-4642 or the next vulnerability affects your stack