What is CVE-2016-10126?

CVE-2016-10126 is a critical-severity vulnerability in Splunk, classified under CWE-264. CVSS score: 9.8/10. Published 2017-01-10.

How severe is CVE-2016-10126?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Splunk

CVE-2016-10126

Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3.x before 6.3.8, and 6.4.x before 6.4.4 allows remote attackers to conduct HTTP request injection attacks and obtain sensitive REST API authentication-token information via unspecified vectors, aka SPL-128840.

EPSS: 0.040 (89.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Splunk — versions 5.0.0, 5.0.1, 5.0.2
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

cve@mitre.org (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
cve@mitre.org (vdb-entry, x_refsource_BID)

Frequently asked questions

What is CVE-2016-10126?: CVE-2016-10126 is a critical-severity vulnerability in Splunk, classified under CWE-264. CVSS score: 9.8/10. Published 2017-01-10.
How severe is CVE-2016-10126?: Critical severity. CVSS v3 base score is 9.8 out of 10.