CVE-2021-26253CWE-287

Bypass of Splunk Enterprise's implementation of DUO MFA

High · published May 6, 2022

CVSS v3.1
8.1
EPSS
1%
Percentile
56.7
In the wild
Unconfirmed
What it is

A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6. The potential vulnerability impacts Splunk Enterprise instances configured to use DUO MFA and does not impact or affect a DUO product or service.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00816 · 56.7th percentile
Weakness
CWE-287 · Improper Authentication
Published
2022-05-06T16:34Z
EPSS history
Timeline
  • 06 MAY 16:34Z
    Bypass of Splunk Enterprise's implementation of DUO MFA
    cvelistv5