CVE-2021-33845 MEDIUM

CVE-2021-33845: Username enumeration through lockout message in REST API

Vendor Splunk

Product Splunk Enterprise

Weakness CWE-203

Published May 6, 2022

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors.

Key dates

02Disclosure timeline

May 6, 2022 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-33845 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/203.html

Related vulnerabilities

04Related CVE

CVE-2022-0823 CVE-2023-43623 CVE-2023-3640 Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and prefetcht2 instructions being used for the per-cpu entry area mapping to the user space CVE-2025-52576 Kanboard vulnerable to Username Enumeration via Login Behavior and Bruteforce Protection Bypass CVE-2024-5124 Timing Attack Vulnerability in gaizhenbiao/chuanhuchatgpt