CyberRota Analysis
AI-GeneratedIn Splunk Enterprise Security versions prior to 8.6.1, users with the ess_analyst role can modify User and Entity Behavior Analytics (UEBA) search macros, which are intended for administrator use only. This misconfiguration allows unauthorized access to sensitive data and compromises system integrity through elevated permissions. Organizations using affected versions should prioritize patching to mitigate the risk of data exposure and unauthorized actions.
Original NVD Description
In Splunk Enterprise Security versions below 8.6.1, a user who holds the ess_analyst Splunk Enterprise Security role could change User and Entity Behavior Analytics (UEBA) search macros that scheduled searches run with administrator permissions, allowing for access to all relevant data and system integrity through those searches. The vulnerability is possible because the UEBA app metadata grants analyst roles write access to search macros that should be writable only by administrator roles. For more information see Users and roles for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/install/8.4/installation/users-and-roles-for-splunk-enterprise-security) and Roles and knowledge objects in UEBA for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.5/user-and-entity-behavior-analytics/roles-and-knowledge-objects-in-ueba-for-splunk-enterprise-security) in the Splunk documentation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)