title: Remote Code Execution via the Splunk Secure Gateway application Mobile Alerts feature
description: In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system commands remotely through the use of specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app.
problem types: CWE-502 Deserialization of Untrusted Data
affected:
{
defaultStatus: affected
product: Splunk Enterprise
vendor: Splunk
versions:
lessThan: 8.1.12, status: affected, version: 8.1, versionType: custom
lessThan: 8.2.9, status: affected, version: 8.2, versionType: custom
lessThan: 9.0.2, status: affected, version: 9.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL