Sensitive information disclosure in Splunk Enterprise and Cloud Platform, caused by insecure logging, could expose valuable data to unauthorized parties.

This is an information disclosure vulnerability (CWE-532) where sensitive information is inadvertently written to log files, potentially providing guidance to an attacker or exposing user credentials.

The exposure of sensitive information in log files can lead to unauthorized access to system internals or user credentials, significantly increasing the risk of a broader security breach. With a CVSS score of 7.5, this issue presents a substantial risk to the confidentiality of data managed within the Splunk environment.

Immediate Action: Apply the latest security patches provided in the vendor advisory for Splunk Enterprise and Cloud Platform.

Proactive Monitoring: Review existing log files for the presence of sensitive data and rotate logs if a breach is suspected.

Compensating Controls: Limit access to log file directories and utilize log aggregation tools that support automated redaction or masking of sensitive information.

Public Exploit Available: No (exploit_available: false)

Administrators should treat this vulnerability with high priority, as log files are often accessible to a wider range of users than the core application. Update your Splunk instances immediately to ensure sensitive data is no longer exposed through system logs.