What is CVE-2021-33845?

CVE-2021-33845 is a medium-severity vulnerability in Splunk, classified under Observable Discrepancy. CVSS score: 5.3/10. Published 2022-05-06.

How severe is CVE-2021-33845?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Splunk

CVE-2021-33845

The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors.

EPSS: 0.009 (54.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Splunk
Splunk Enterprise — versions Version(s) before 8.1.7

Weakness classification (CWE)

CWE-203 — Observable Discrepancy

References

prodsec@splunk.com (x_refsource_MISC, Vendor Advisory)
prodsec@splunk.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-33845?: CVE-2021-33845 is a medium-severity vulnerability in Splunk, classified under Observable Discrepancy. CVSS score: 5.3/10. Published 2022-05-06.
How severe is CVE-2021-33845?: Medium severity. CVSS v3 base score is 5.3 out of 10.