A critical path traversal vulnerability in Splunk Enterprise allows authenticated attackers to access sensitive system files outside of intended directories.

This is a path traversal vulnerability (CWE-26) involving the improper handling of pathname construction. The flaw allows an authenticated user (PR:L) to traverse the directory structure and access unauthorized files on the host system.

By accessing files outside of the intended scope, an attacker may read configuration files, credentials, or sensitive system data stored on the server. This compromise can facilitate further escalation of privileges or result in the exposure of proprietary information. The CVSS score of 8.8 underscores the high risk to confidentiality and system integrity.

Immediate Action: Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, 9.4.14, or higher to resolve the directory traversal flaw.

Proactive Monitoring: Review file access logs for attempts to access paths containing directory traversal sequences, such as double dots or forward slashes.

Compensating Controls: Implement file system permissions that restrict the service account running Splunk to only the necessary directories and files.

Public Exploit Available: Unknown

Securing the file system is a critical component of maintaining a hardened Splunk environment. Administrators must patch affected systems immediately to prevent unauthorized file access and potential system compromise.