In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the _internal index could view session cookies and response bodies that contain sensitive data. The vulnerability is caused by missing output buffer sanitization in the TcpChannel component, which logs full I/O buffer contents at WARN level when discarding data during socket errors. See role-based user access in the Splunk documentation for more information.
Upgrade Splunk Enterprise to versions 10.2.2, 10.0.5, or higher. Splunk is actively monitoring and patching Splunk Cloud Platform instances.
To eliminate further risk and help ensure a high level of security in your environment, review roles and capabilities on your instance and restrict _internal index access to administrator level roles. See Define roles on the Splunk platform with capabilities in the Splunk documentation for more information.
Splunk rates this vulnerability a 7.5, High, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
Charlie Huggard, Splunk
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
