What is CVE-2021-31559?

CVE-2021-31559 is a high-severity vulnerability in Splunk, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 7.5/10. Published 2022-05-06.

How severe is CVE-2021-31559?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Splunk

CVE-2021-31559

A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impact Universal Forwarders.

EPSS: 0.009 (54.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Splunk — versions 8.2.0
Splunk Enterprise — versions 8.2 version(s) before 8.2.1, Version(s) before 8.1.5

Weakness classification (CWE)

CWE-288 — Authentication Bypass Using an Alternate Path or Channel

References

prodsec@splunk.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-31559?: CVE-2021-31559 is a high-severity vulnerability in Splunk, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 7.5/10. Published 2022-05-06.
How severe is CVE-2021-31559?: High severity. CVSS v3 base score is 7.5 out of 10.