CVE-2017-17067

CRITICAL 9.8CVE-2017-17067 · Published 30/11/2017 · updated 17/06/2026

In short

CVE-2017-17067 is a CRITICAL (CVSS 9.8) vulnerability affecting splunk (splunk).
Chance of exploitation in the next 30 days (EPSS): 3.0%, higher than 87.2% of all vulnerabilities.
Fix: update to 6.3.12, 6.4.9, 6.5.6, 6.6.3.2 or later.

Package	Affected versions	Patched versions
splunk splunk	`≥ 6.3.0, < 6.3.12≥ 6.4.0, < 6.4.9≥ 6.5.0, < 6.5.6≥ 6.6.0, < 6.6.3.2≥ 7.0.0, < 7.0.0.1`	`6.3.126.4.96.5.66.6.3.27.0.0.1`

Description

Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and 6.3.x before 6.3.12, when the SAML authType is enabled, mishandles SAML, which allows remote attackers to bypass intended access restrictions or conduct impersonation attacks.

References

securityfocus.com/bid/102005 · Third Party Advisory
splunk.com/view/SP-CAAAP3K · Vendor Advisory

More vulnerabilities in splunk

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

splunk

≥ 6.3.0, < 6.3.12≥ 6.4.0, < 6.4.9≥ 6.5.0, < 6.5.6≥ 6.6.0, < 6.6.3.2≥ 7.0.0, < 7.0.0.1

6.3.126.4.96.5.66.6.3.27.0.0.1

More vulnerabilities in splunk

See all →