title: Deserialization of Untrusted Data on Splunk Enterprise for Windows through Path Traversal from Separate Disk Partition
description: In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerability only affects Splunk Enterprise for Windows.
problem types: The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.
affected:
{
product: Splunk Enterprise
vendor: Splunk
versions:
version: 9.0, status: affected, versionType: custom, lessThan: 9.0.8
version: 9.1, status: affected, versionType: custom, lessThan: 9.1.3
}
metrics:
cvssV3_1: [
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
baseScore: 7.5
baseSeverity: HIGH
]
format: CVSS
scenarios: GENERAL