CVE-2016-10126 Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3.x before 6.3.8, and 6.4.x before 6.4.4 allows remote attackers to conduct HTTP r...
CriticalCVSS 9.8
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3.x before 6.3.8, and 6.4.x before 6.4.4 allows remote attackers to conduct HTTP request injection attacks and obtain sensitive REST API authentication-token information via unspecified vectors, aka SPL-128840.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| splunk | = 5.0.0 | No fix listed |
| splunk | = 5.0.1 | No fix listed |
| splunk | = 5.0.2 | No fix listed |
| splunk | = 5.0.3 | No fix listed |
| splunk | = 5.0.4 | No fix listed |
| splunk | = 5.0.5 | No fix listed |
| splunk | = 5.0.6 | No fix listed |
| splunk | = 5.0.7 | No fix listed |
| splunk | = 5.0.8 | No fix listed |
| splunk | = 5.0.9 | No fix listed |
| splunk | = 5.0.10 | No fix listed |
| splunk | = 5.0.11 | No fix listed |
| splunk | = 5.0.12 | No fix listed |
| splunk | = 5.0.13 | No fix listed |
| splunk | = 5.0.14 | No fix listed |
| splunk | = 5.0.15 | No fix listed |
| splunk | = 5.0.16 | No fix listed |
| splunk | = 6.0.0 | No fix listed |
| splunk | = 6.0.1 | No fix listed |
| splunk | = 6.0.2 | No fix listed |
| splunk | = 6.0.3 | No fix listed |
| splunk | = 6.0.4 | No fix listed |
| splunk | = 6.0.5 | No fix listed |
| splunk | = 6.0.6 | No fix listed |
| splunk | = 6.0.7 | No fix listed |
Show 41 more
| Product | Affected versions | Fixed in |
|---|---|---|
| splunk | = 6.0.8 | No fix listed |
| splunk | = 6.0.9 | No fix listed |
| splunk | = 6.0.10 | No fix listed |
| splunk | = 6.0.11 | No fix listed |
| splunk | = 6.0.12 | No fix listed |
| splunk | = 6.1.0 | No fix listed |
| splunk | = 6.1.1 | No fix listed |
| splunk | = 6.1.2 | No fix listed |
| splunk | = 6.1.3 | No fix listed |
| splunk | = 6.1.4 | No fix listed |
| splunk | = 6.1.5 | No fix listed |
| splunk | = 6.1.6 | No fix listed |
| splunk | = 6.1.7 | No fix listed |
| splunk | = 6.1.8 | No fix listed |
| splunk | = 6.1.9 | No fix listed |
| splunk | = 6.1.10 | No fix listed |
| splunk | = 6.1.11 | No fix listed |
| splunk | = 6.2.0 | No fix listed |
| splunk | = 6.2.1 | No fix listed |
| splunk | = 6.2.2 | No fix listed |
| splunk | = 6.2.3 | No fix listed |
| splunk | = 6.2.4 | No fix listed |
| splunk | = 6.2.5 | No fix listed |
| splunk | = 6.2.6 | No fix listed |
| splunk | = 6.2.7 | No fix listed |
| splunk | = 6.2.8 | No fix listed |
| splunk | = 6.2.9 | No fix listed |
| splunk | = 6.2.10 | No fix listed |
| splunk | = 6.2.11 | No fix listed |
| splunk | = 6.3.0 | No fix listed |
| splunk | = 6.3.1 | No fix listed |
| splunk | = 6.3.2 | No fix listed |
| splunk | = 6.3.3 | No fix listed |
| splunk | = 6.3.4 | No fix listed |
| splunk | = 6.3.5 | No fix listed |
| splunk | = 6.3.6 | No fix listed |
| splunk | = 6.3.7 | No fix listed |
| splunk | = 6.4.0 | No fix listed |
| splunk | = 6.4.1 | No fix listed |
| splunk | = 6.4.2 | No fix listed |
| splunk | = 6.4.3 | No fix listed |
References
- 95412 vdb-entry
- www.splunk.com mitigation vendor-advisory