Splunk security advisories, May 2022

Every Splunk security advisory published in May 2022, from Splunk Security Advisories (advisory.splunk.com) + NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 7
Critical: 0
High: 5
In CISA KEV: 0
CVEs: 7

Splunk advisories published in May 2022

May 6, 2022
High [CVE-2022-27183] Splunk Enterprise: The Monitoring Console app configured in Distributed mode
High8.8
May 6, 2022
High [CVE-2022-26889] In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path…
High8.8
May 6, 2022
High [CVE-2021-42743] Splunk Enterprise: misconfiguration in the node default path
High8.8
May 6, 2022
High [CVE-2021-31559] crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1…
High7.5
May 6, 2022
High [CVE-2021-26253] potential vulnerability in Splunk Enterprise's implementation of DUO MFA
High8.1
May 6, 2022
Medium [CVE-2022-26070] Splunk Enterprise: When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response
Medium4.3
May 6, 2022
Medium [CVE-2021-33845] Splunk Enterprise: The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message.
Medium5.3

Get an email when Splunk publishes the next one.

See Splunk's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Splunk

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.