CyberRota Analysis
AI-GeneratedIn Splunk Enterprise versions 10.4 and below 10.4.2, an unauthenticated user can access Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, potentially exposing sensitive runtime and build metadata. This information disclosure occurs due to the lack of authentication on the metrics endpoint, allowing any reachable client to retrieve the data without credentials. Organizations using affected versions of Splunk Enterprise should prioritize patching to mitigate this high-severity vulnerability.
Original NVD Description
In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnerability does not affect Splunk Enterprise versions below 10.4. The information disclosure is possible because the Prometheus metrics endpoint in the Edge Processor SPL2 Preview sidecar lacks authentication, which lets any client that can reach the sidecar retrieve the metrics without credentials. For more information see About Splunk sidecars (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/splunk-sidecars/about-splunk-sidecars) in the Splunk documentation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)