CyberRota Analysis
AI-GeneratedSplunk Enterprise and Splunk Secure Gateway versions prior to specified updates are vulnerable to unauthorized users exploiting crafted report notification data to manipulate the REST API, potentially allowing them to alter platform configurations and access sensitive data without proper authentication. This vulnerability poses a significant risk to system integrity, as it enables non-admin users to gain elevated access through a system-level session token. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access and data compromise.
Original NVD Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to the Splunk Enterprise Representational State Transfer (REST) API using a system-level session token and modify the Splunk platform configuration. The user could then obtain a session token without a password and use it to access all relevant data and affect system integrity. The vulnerability is possible because Splunk Secure Gateway does not validate decoded report notification identifiers before using them to construct requests to the Splunk Enterprise REST API.
Related CVEs
Other vulnerabilities affecting the same vendor(s)