Code injection

The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors...

Design/Logic Flaw

The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, and not installed on Splunk Cloud Platfo...

Path traversal

In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page e.g., HTML Injection, XSS or bypass SPL safeguards for risky commands. The attack...

Path traversal

When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. The vulnerability impacts Splunk Enterprise versions before 8.1.0...

CVE-2022-27183 Reflected XSS in a query parameter of the Monitoring Console

The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, and not installed on Splunk Cloud Platfo...

CVE-2022-26889

Splunk Enterprise before 8.1.2 is vulnerable to a path traversal flaw in the URI path used to load a relative resource within a web page. The root cause is lack of proper filtering of relative URL paths, enabling potential arbitrary content injection (HTML Injection, XSS) or bypass of SPL safegua...

CVE-2022-26889 Path Traversal in search parameter results in external content injection

In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page e.g., HTML Injection, XSS or bypass SPL safeguards for risky commands. The attack...

CVE-2022-26070 Error message discloses internal path

When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. The vulnerability impacts Splunk Enterprise versions before 8.1.0...

CVE-2022-26070

CVE-2022-26070 affects Splunk Enterprise versions before 8.1.0. The issue is information disclosure: when handling a mismatched pre-authentication cookie, the response leaks the Splunk local system path in an internal error message. Red Hat and other sources corroborate the same description; Red ...

CVE-2021-42743 Local privilege escalation via a default path in Splunk Enterprise Windows

A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions before 8.1.1 on Windows...

CVE-2021-42743

CVE-2021-42743 is a local privilege escalation in Splunk Enterprise for Windows caused by a misconfiguration of the default node path, enabling a lower-privileged user to gain the Splunk user’s privileges on Splunk Enterprise versions before 8.1.1. Evidence from multiple sources (NVD, Red Hat, Ne...

CVE-2021-33845 Username enumeration through lockout message in REST API

The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors...

CVE-2021-31559

Splunk Enterprise Indexer authentication bypass (CVE-2021-31559) affects 8.1.x before 8.1.5 and 8.2.x before 8.2.1 for Indexers using TCPTokens; a crafted request bypasses S2S TCP Token authentication and can write arbitrary events to an index, while Universal Forwarders are unaffected. Connected...

CVE-2021-26253

CVE-2021-26253 describes a bypass of Splunk Enterprise’s Duo MFA in versions prior to 8.1.6. The vulnerability affects Splunk Enterprise instances configured to use Duo MFA; it does not impact Duo’s products or services. Connected sources confirm an MFA bypass risk tied to Splunk’s MFA implementa...

CVE-2021-26253 Bypass of Splunk Enterprise's implementation of DUO MFA

A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6. The potential vulnerability impacts Splunk Enterprise instances configured to use DUO MFA and does not impact or affect a DUO product or...

CVE-2022-26070: Exposure of Sensitive Information to an Unauthorized Actor

When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. The vulnerability impacts Splunk Enterprise versions before 8.1.0...

CVE-2021-26253: Improper Authentication

A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6. The potential vulnerability impacts Splunk Enterprise instances configured to use DUO MFA and does not impact or affect a DUO product or...

PT-2022-18274

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 8.1.4 Description The issue concerns a Reflected XSS in a query parameter within the Monitoring Console app when configured in Distributed mode. This app is bundled with Splunk Enterprise and is not...

CVE-2022-27183: Improper Neutralization of Input During Web Page Generation

The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, and not installed on Splunk Cloud Platfo...

CVE-2022-26889: Improper Input Validation

In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page e.g., HTML Injection, XSS or bypass SPL safeguards for risky commands. The attack...