CVE-2023-32709 MEDIUM

CVE-2023-32709: Low-privileged User can View Hashed Default Splunk Password

Vendor Splunk
Product Splunk Enterprise
Weakness CWE-285
Published June 1, 2023
Last update February 28, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user’ role can see the hashed version of the initial user name and password for the Splunk instance by using the ‘rest’ SPL command against the ‘conf-user-seed’ REST endpoint.

Key dates

02Disclosure timeline

June 1, 2023 CVE published
February 28, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-12213 hcengineering Huly Platform User Information operations.ts getAccountInfo improper authorization CVE-2026-7644 ChatGPTNextWeb NextChat actions.ts addMcpServer improper authorization CVE-2024-13821 WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation CVE-2026-30956 OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header CVE-2025-4103 WP-GeoMeta 0.3.4 - 0.3.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via wp_ajax_wpgm_start_geojson_import Function