© 2005 - 2023 Splunk Inc. All rights reserved.
Advisory ID: SVD-2022-0502
Published: 22022-05-03
CVSSv3.1 Score: 5.3, Medium
CWE: CWE-203
CVE ID: CVE-2021-33845
Last Update: 2022-05-03
CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Security Content: Splunk User Enumeration Attempt
Description
The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors.
See Authentication.conf for more information on verboseLoginFailMsg setting. If the Splunk Enterprise instance uses the default verboseLoginFailMsg or sets verboseLoginFailMsg to true, it is not impacted. However, we strongly recommend setting verboseLoginFailMsg to false.
The vulnerability does not allow the enumeration of users with the default admin role or never_lockout capability. See Roles and capabilities for more formation on never_lockout.
Upgrade Splunk Enterprise versions to 8.1.7 or later.
| Product | Version | Affected Versions | Fix Version |
|---|---|---|---|
| Splunk Enterprise | 8.2 | - | 8.2.0 |
| Splunk Enterprise | 8.1 | 8.1.6 and earlier | 8.1.7 |
The vulnerability does not impact Splunk Cloud Platform instances.
Acknowledgments
Kyle Bambrick at Splunk
© 2005 - 2023 Splunk Inc. All rights reserved.