A critical authorization bypass flaw in Splunk Enterprise permits authenticated users to perform unauthorized operations, necessitating an immediate software update and configuration change.

This is an improper authorization vulnerability, categorized as CWE-285, where the software fails to enforce security constraints for specific actions. The vulnerability is accessible to authenticated users with low privileges.

The ability to bypass authorization checks can lead to unauthorized data access, modification of system configurations, or elevation of privileges. With a CVSS score of 8.8, this vulnerability represents a severe risk to data integrity and system security, as users may perform actions they are not permitted to execute.

Immediate Action: Upgrade to Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14, and manually set the configuration parameter scripted_lookup_raw_write_enforcement = block in limits.conf under the [lookup] section, followed by a service restart.

Proactive Monitoring: Audit user activity logs to detect unexpected modifications to lookups or unauthorized attempts to access restricted system functions.

Compensating Controls: Implement strict access control lists (ACLs) and review user permissions to ensure the principle of least privilege is strictly enforced while the patch is being applied.

Public Exploit Available: unknown

Administrators must complete both the software upgrade and the mandatory configuration change provided by the vendor. Failure to apply the configuration change may leave the system vulnerable even after the software update is installed.