| Package | Affected versions | Patched versions |
|---|---|---|
| splunk | ≥ 10.0.0, < 10.0.2≥ 9.2.0, < 9.2.12≥ 9.3.0, < 9.3.9≥ 9.4.0, < 9.4.8 | 10.0.29.2.129.3.99.4.8 |
| splunk cloud platform | ≥ 10.0.2503, < 10.0.2503.9≥ 10.1.2507, < 10.1.2507.8≥ 10.2.2510, < 10.2.2510.3≥ 9.3.2411, < 9.3.2411.121 | 10.0.2503.910.1.2507.810.2.2510.39.3.2411.121 |
In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12, and Splunk Cloud Platform versions below 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, and 9.3.2411.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload into the `realname`, `tz`, or `email` parameters of the `/splunkd/__raw/services/authentication/users/username` REST API endpoint when they change a password. This could potentially lead to a client‑side denial‑of‑service (DoS). The malicious payload might significantly slow page load times or render Splunk Web temporarily unresponsive.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free