Auth bypass in Splunk

CVE-2011-4644

Splunk 4.2.5 and earlier, when a Free license is selected, enables potentially undesirable functionality within an environment that intentionally does not support authentication, which allows remote attackers to (1) read arbitrary files via a management-console session that leverages the ability to create crafted data sources, or (2) execute management commands via an HTTP request.

Vulnerability class: Broken Authentication

EPSS: 0.078 (94.1th percentile) — read the EPSS interpretation.

Affected products

  • Splunk — versions 2.1, 2.2, 2.2.1
  • N/a — versions n/a

Weakness classification (CWE)

References