CVE-2022-26070CWE-200
Error message discloses internal path
Medium · published May 6, 2022
What it is
When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. The vulnerability impacts Splunk Enterprise versions before 8.1.0.
The record
Technical detail
- CVSS v3.1
- 4.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00649 · 50.4th percentile
- Weakness
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- Published
- 2022-05-06T16:37Z
EPSS history
Timeline