6.3

CVE-2026-20165

In Splunk Enterprise versions below 10.2.1, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.7, 10.1.2507.17, 10.0.2503.12, and 9.3.2411.124, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve sensitive information by inspecting the job's search log due to improper access control in the MongoClient logging channel.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerSplunk
≫
Produkt Splunk Enterprise
Version < 10.2.1
Version 10.2
Status affected
Version < 10.0.4
Version 10.0
Status affected
Version < 9.4.9
Version 9.4
Status affected
Version < 9.3.10
Version 9.3
Status affected
HerstellerSplunk
≫
Produkt Splunk Cloud Platform
Version < 10.2.2510.7
Version 10.2.2510
Status affected
Version < 10.1.2507.17
Version 10.1.2507
Status affected
Version < 10.0.2503.12
Version 10.0.2503
Status affected
Version < 9.3.2411.124
Version 9.3.2411
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.04% 0.122
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
psirt@cisco.com 6.3 2.8 3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.