Multiple Splunk Enterprise Vulnerabilities Enable Path Traversal and Information Disclosure Attacks
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Splunk has released security updates addressing multiple vulnerabilities in Splunk Enterprise and Splunk Cloud Platform.<\/p>\n
These flaws could lead to issues such as path traversal, disclosure of stored credential hashes, and arbitrary execution of SPL (Search Processing Language)<\/a> searches. Three security vulnerabilities affecting both Splunk Enterprise and Splunk Cloud Platform have been patched.<\/p>\n These issues impact the REST API and Splunk Web components, potentially allowing authorized users or phishing attackers to access sensitive data, write files to unintended directories, or execute arbitrary searches.<\/p>\n The most critical vulnerability, tracked as CVE-2026-20296 (SVD-2026-0702<\/a>), has a CVSS score of 8.3. It impacts the Deployment Server component within Splunk Web.<\/p>\n An unauthenticated attacker could exploit this flaw by tricking a user with the This attack takes advantage of the lack of CSRF (Cross-Site Request Forgery) validation on GET requests and insufficient handling of user-controlled input in SPL searches.<\/p>\n If successfully exploited, attackers could execute arbitrary SPL searches as the splunk-system-user, potentially exposing indexed data and stored credentials.<\/a><\/p>\n However, this exploitation requires user interaction; thus, an attacker cannot trigger the issue remotely without first phishing the target.<\/p>\n Additionally, CVE-2026-20297 (SVD-2026-0703<\/a>) is a high-severity path traversal vulnerability rated with a CVSS score of 7.2. This issue exists in the App Install REST endpoint and involves the explicit_appname parameter.<\/p>\n A user with both edit_local_apps and install_apps capabilities could exploit this flaw during a valid app installation.<\/p>\n The vulnerable workflow could allow files to be written outside the intended application directory and into the $SPLUNK_HOME\/etc\/ directory or its subdirectories, which could affect application configurations and other sensitive Splunk files.<\/p>\n Lastly, CVE-2026-20298 (SVD-2026-0704<\/a>) is a medium-severity information disclosure issue rated 5.3. A low-privileged user without admin or power roles could access the This endpoint could return the Splunk Enterprise users are advised to upgrade to the following fixed releases: 10.4.1, 10.2.5, 10.0.8, 9.4.13, or later. The path traversal issue also affects the 9.3 branch, which requires version 9.3.14.<\/p>\n For CVE-2026-20298, administrators must configure limits.conf with Splunk Cloud Platform customers are being patched and monitored by Splunk<\/a>. For CVE-2026-20296, organizations that cannot update immediately can reduce their exposure by disabling Splunk Web where it is not needed.<\/p>\n \u00a0Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations.\u00a0->\u00a0Integrate ANY.RUN With Your SOC\u00a0<\/a>Now<\/a><\/strong>.<\/strong><\/p>\n The post Multiple Splunk Enterprise Vulnerabilities Enable Path Traversal and Information Disclosure Attacks<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nMultiple Splunk Enterprise Vulnerabilities<\/strong><\/h2>\n
list_deployment_serve<\/code>r capability into opening a malicious link or webpage.<\/p>\n \/servicesNS\/-\/-\/storage\/passwords<\/code> REST endpoint through the | rest<\/code> SPL command.<\/p>\nencr_password<\/code> field, which exposes stored credential hashes to unauthorized users. While the flaw requires authentication and has a high attack complexity rating, the exposed hashes could facilitate offline password-cracking attempts or further compromise.<\/p>\nmask_encr_password = true<\/code> under the [storage_passwords_masking] stanza, and then restart Splunk Enterprise.<\/p>\n