CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-42743 – Local privilege escalation via a default path in Splunk Enterprise Windows
https://notcve.org/view.php?id=CVE-2021-42743
06 May 2022 — A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions before 8.1.1 on Windows. Una configuración errónea en la ruta por defecto del nodo permite una escalada de privilegios local de un usuario menos privilegiado al usuario de Splunk en Splunk Enterprise versiones anteriores a 8.1.1 en Windows • https://www.splunk.com/en_us/product-security/announcements/svd-2022-0501.html • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-3422 – Indexer denial-of-service via malformed S2S request
https://notcve.org/view.php?id=CVE-2021-3422
25 Mar 2022 — The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both r... • https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders • CWE-20: Improper Input Validation CWE-125: Out-of-bounds Read •
CVSS: 5.3EPSS: 90%CPEs: 1EXPL: 4CVE-2018-11409 – Splunk < 7.0.1 - Information Disclosure
https://notcve.org/view.php?id=CVE-2018-11409
08 Jun 2018 — Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key. Splunk hasta la versión 7.0.1 permite la divulgación de información anexando __raw/services/server/info/server-info?output_mode=json en una consulta, tal y como queda demostrado con el descubrimiento de una clave de licencia. Splunk 6.2.3 through 7.0.1 allows information disclosure by appending /__raw/services/server/info/server-inf... • https://packetstorm.news/files/id/180639 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 3%CPEs: 5EXPL: 0CVE-2017-17067
https://notcve.org/view.php?id=CVE-2017-17067
30 Nov 2017 — Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and 6.3.x before 6.3.12, when the SAML authType is enabled, mishandles SAML, which allows remote attackers to bypass intended access restrictions or conduct impersonation attacks. Splunk Web en Splunk Enterprise en versiones 7.0.x anteriores a la 7.0.0.1; versiones 6.6.x anteriores a la 6.6.3.2; versiones 6.5.x anteriores a la 6.5.6; versiones 6.4.x anteriores a la 6.4.9 y versiones 6.3.x ante... • http://www.securityfocus.com/bid/102005 • CWE-863: Incorrect Authorization •