4.3

CVE-2026-20139

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12, and Splunk Cloud Platform versions below 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, and 9.3.2411.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload into the `realname`, `tz`, or `email` parameters of the `/splunkd/__raw/services/authentication/users/username` REST API endpoint when they change a password. This could potentially lead to a client‑side denial‑of‑service (DoS). The malicious payload might significantly slow page load times or render Splunk Web temporarily unresponsive.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Splunk ≫ Splunk SwEditionenterprise Version >= 9.2.0 < 9.2.12
Splunk ≫ Splunk SwEditionenterprise Version >= 9.3.0 < 9.3.9
Splunk ≫ Splunk SwEditionenterprise Version >= 9.4.0 < 9.4.8
Splunk ≫ Splunk SwEditionenterprise Version >= 10.0.0 < 10.0.2
Splunk ≫ Splunk Cloud Platform Version >= 9.3.2411 < 9.3.2411.121
Splunk ≫ Splunk Cloud Platform Version >= 10.0.2503 < 10.0.2503.9
Splunk ≫ Splunk Cloud Platform Version >= 10.1.2507 < 10.1.2507.8
Splunk ≫ Splunk Cloud Platform Version >= 10.2.2510 < 10.2.2510.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.06% 0.184
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
psirt@cisco.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.