CVE-2022-26070 MEDIUM

CVE-2022-26070: Error message discloses internal path

Vendor Splunk
Product Splunk Enterprise
Weakness CWE-200 · Info exposure
Published May 6, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. The vulnerability impacts Splunk Enterprise versions before 8.1.0.

Key dates

02Disclosure timeline

May 6, 2022 CVE published
August 3, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-32953 z80pack Vulnerable to Exposure of the GITHUB_TOKEN in Workflow Run Artifact CVE-2021-24945 Like Button Rating < 2.6.38 - Unauthorised Vote Export to Email & IP Addresses Disclosure CVE-2024-30300 Tenable Vulnerability Disclosure | Sensitive Information Disclosure Via Fake FMPS Worker CVE-2025-2331 GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure CVE-2024-5202 Dimensions RM - Arbitrary File Read