‘edit_user’ Capability Privilege Escalation
Splunk · Splunk Enterprise
The flaw is an improper authorization issue in the Splunk Enterprise web interface that lets a user whose role holds the 'edit_user' capability escalate their privileges to those of the admin user. Exploitation requires that the attacker already hold a low-privileged account with a role that has 'edit_user' assigned, and then only needs to send specially crafted web requests, with no user interaction or special configuration described.
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (Metasploit) was available the same day.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.