CVE-2022-27183

CVE-2022-27183 describes a Reflected XSS in the Monitoring Console app when deployed in Distributed mode of Splunk Enterprise prior to version 8.1.4 . The vulnerability occurs in a query parameter and affects the bundled Monitoring Console app (not SplunkBase or Cloud Monitoring Console). The CVE...

CVE-2022-26889 Path Traversal in search parameter results in external content injection

In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page e.g., HTML Injection, XSS or bypass SPL safeguards for risky commands. The attack...

CVE-2022-26889

Splunk Enterprise before 8.1.2 is vulnerable to a path traversal flaw in the URI path used to load a relative resource within a web page. The root cause is lack of proper filtering of relative URL paths, enabling potential arbitrary content injection (HTML Injection, XSS) or bypass of SPL safegua...

CVE-2022-26070

CVE-2022-26070 affects Splunk Enterprise versions before 8.1.0. The issue is information disclosure: when handling a mismatched pre-authentication cookie, the response leaks the Splunk local system path in an internal error message. Red Hat and other sources corroborate the same description; Red ...

CVE-2022-26070 Error message discloses internal path

When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. The vulnerability impacts Splunk Enterprise versions before 8.1.0...

CVE-2021-42743

CVE-2021-42743 is a local privilege escalation in Splunk Enterprise for Windows caused by a misconfiguration of the default node path, enabling a lower-privileged user to gain the Splunk user’s privileges on Splunk Enterprise versions before 8.1.1. Evidence from multiple sources (NVD, Red Hat, Ne...

CVE-2021-42743 Local privilege escalation via a default path in Splunk Enterprise Windows

A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions before 8.1.1 on Windows...

CVE-2021-33845

CVE-2021-33845 affects Splunk Enterprise before version 8.1.7, where the REST API can disclose usernames via the lockout error message when verbose login errors are present. Multiple connected sources (NVD, Red Hat, Nessus plugin, CVE lists) describe this information disclosure vulnerability and ...

CVE-2021-33845 Username enumeration through lockout message in REST API

The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors...

CVE-2021-31559 S2S TcpToken authentication bypass

A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impact Universal Forwarders...

CVE-2021-31559

Splunk Enterprise Indexer authentication bypass (CVE-2021-31559) affects 8.1.x before 8.1.5 and 8.2.x before 8.2.1 for Indexers using TCPTokens; a crafted request bypasses S2S TCP Token authentication and can write arbitrary events to an index, while Universal Forwarders are unaffected. Connected...

CVE-2021-26253 Bypass of Splunk Enterprise's implementation of DUO MFA

A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6. The potential vulnerability impacts Splunk Enterprise instances configured to use DUO MFA and does not impact or affect a DUO product or...

CVE-2021-26253

CVE-2021-26253 describes a bypass of Splunk Enterprise’s Duo MFA in versions prior to 8.1.6. The vulnerability affects Splunk Enterprise instances configured to use Duo MFA; it does not impact Duo’s products or services. Connected sources confirm an MFA bypass risk tied to Splunk’s MFA implementa...

Vulnerabilities fixed in Splunk

Vulnerabilities have been fixed in Splunk. The vulnerabilities potentially enable a malicious person to carry out attacks leading to the following categories of damage: Cross-Site Scripting XSS. Circumvention of security measure Access to system data Increased user privileges Updates have been...

PT-2022-18124 · Splunk · Splunk Enterprise

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 8.1.2 Description: The issue allows an attacker to potentially inject arbitrary content into a web page, such as HTML Injection or XSS, or bypass safeguards for risky commands. This is due to a path travers...

PT-2022-10035 · Splunk · Splunk Enterprise Indexer

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise Indexer versions 8.1 through 8.1.4 Splunk Enterprise Indexer versions 8.2 through 8.2.0 Description: A crafted request can bypass S2S TCP Token authentication, allowing arbitrary events to be written to an index. This issue...

PT-2022-9720 · Splunk · Splunk Enterprise

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 8.1.6 Description: A potential issue in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification. This issue impacts Splunk Enterprise instances configured to use DUO MFA and...

Splunk 路径遍历漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A path...

Splunk Enterprise 代码问题漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

Splunk Enterprise 安全漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...