CVE-2021-26253 HIGH

CVE-2021-26253: Bypass of Splunk Enterprise's implementation of DUO MFA

Vendor Splunk
Product Splunk Enterprise
Weakness CWE-287 · Improper authentication
Published May 6, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6. The potential vulnerability impacts Splunk Enterprise instances configured to use DUO MFA and does not impact or affect a DUO product or service.

Key dates

02Disclosure timeline

May 6, 2022 CVE published
August 3, 2024 Record updated