CVE-2016-10126: Critical severity splunk vulnerability

Published Jan 10, 2017

Updated

Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3.x before 6.3.8, and 6.4.x before 6.4.4 allows remote attackers to conduct HTTP request injection attacks and obtain sensitive REST API authentication-token information via unspecified vectors, aka SPL-128840.

Affected Software

66 affected components

Splunk splunk=5.0.0

Splunk splunk=5.0.1

Splunk splunk=5.0.2

Splunk splunk=5.0.3

Splunk splunk=5.0.4

Splunk splunk=5.0.5

Splunk splunk=5.0.6

Splunk splunk=5.0.7

Splunk splunk=5.0.8

Splunk splunk=5.0.9

Splunk splunk=5.0.10

Splunk splunk=5.0.11

Splunk splunk=5.0.12

Splunk splunk=5.0.13

Splunk splunk=5.0.14

Splunk splunk=5.0.15

Splunk splunk=5.0.16

Splunk splunk=6.0.0

Splunk splunk=6.0.1

Splunk splunk=6.0.2

Splunk splunk=6.0.3

Splunk splunk=6.0.4

Splunk splunk=6.0.5

Splunk splunk=6.0.6

Splunk splunk=6.0.7

Splunk splunk=6.0.8

Splunk splunk=6.0.9

Splunk splunk=6.0.10

Splunk splunk=6.0.11

Splunk splunk=6.0.12

Splunk splunk=6.1.0

Splunk splunk=6.1.1

Splunk splunk=6.1.2

Splunk splunk=6.1.3

Splunk splunk=6.1.4

Splunk splunk=6.1.5

Splunk splunk=6.1.6

Splunk splunk=6.1.7

Splunk splunk=6.1.8

Splunk splunk=6.1.9

Splunk splunk=6.1.10

Splunk splunk=6.1.11

Splunk splunk=6.2.0

Splunk splunk=6.2.1

Splunk splunk=6.2.2

Splunk splunk=6.2.3

Splunk splunk=6.2.4

Splunk splunk=6.2.5

Splunk splunk=6.2.6

Splunk splunk=6.2.7

Splunk splunk=6.2.8

Splunk splunk=6.2.9

Splunk splunk=6.2.10

Splunk splunk=6.2.11

Splunk splunk=6.3.0

Splunk splunk=6.3.1

Splunk splunk=6.3.2

Splunk splunk=6.3.3

Splunk splunk=6.3.4

Splunk splunk=6.3.5

Splunk splunk=6.3.6

Splunk splunk=6.3.7

Splunk splunk=6.4.0

Splunk splunk=6.4.1

Splunk splunk=6.4.2

Splunk splunk=6.4.3

Event History

Jan 10, 2017

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Data Sourced

via NVD·11:59 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-10126?

CVE-2016-10126 has a moderate severity level, allowing attackers to conduct HTTP request injection attacks.

How do I fix CVE-2016-10126?

To fix CVE-2016-10126, you should upgrade Splunk Enterprise to a version that is 5.0.17 or higher, or 6.0.13 or higher.

What versions of Splunk Enterprise are affected by CVE-2016-10126?

CVE-2016-10126 affects versions of Splunk Enterprise from 5.0.0 up to, but not including, 5.0.17, and similarly for versions 6.0.0 to 6.0.12, as well as several other 6.x versions.

Can CVE-2016-10126 allow access to sensitive information?

Yes, CVE-2016-10126 enables remote attackers to obtain sensitive REST API authentication-token information.

Is CVE-2016-10126 a remote code execution vulnerability?

No, CVE-2016-10126 is an HTTP request injection vulnerability, not a remote code execution vulnerability.