Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2021-33845

Username enumeration through lockout message in REST API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Splunk

Description

The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Splunk Splunk Enterprise

  • Version(s) before 8.1.7affected

References