PT-2022-9720 · Splunk · Splunk Enterprise

Sanket Bhimani · Published 2022-05-06 · Updated 2022-08-01 · CVE-2021-26253

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 8.1.6

Description A potential issue in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification. This issue impacts Splunk Enterprise instances configured to use DUO MFA and does not affect any DUO product or service.

Recommendations For versions prior to 8.1.6, update to version 8.1.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the MFA verification process until a patch is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-26253

Affected Products

Splunk Enterprise

References · 5

• https://osv.dev/vulnerability/CVE-2021-26253 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26253 · Security Note
• https://splunk.com/en_us/product-security/announcements/svd-2022-0504.html · Vendor Advisory
• https://t.me/cvenotify/30318 · Telegram Post
• https://t.me/cibsecurity/42118 · Telegram Post