vulnerability
Splunk: CVE-2021-33845: Username enumeration through lockout message in REST API
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:L/Au:N/C:P/I:N/A:N) | May 3, 2022 | Apr 7, 2025 | Oct 8, 2025 |
Severity
5
CVSS
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
Published
May 3, 2022
Added
Apr 7, 2025
Modified
Oct 8, 2025
Description
The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors. SeeAuthentication.conffor more information on verboseLoginFailMsg setting. If the Splunk Enterprise instance uses the default verboseLoginFailMsg or sets verboseLoginFailMsg to true, it is not impacted. However, we strongly recommend setting verboseLoginFailMsg to false. The vulnerability does not allow the enumeration of users with the default admin role or never_lockout capability. SeeRoles and capabilitiesfor more formation on never_lockout.
Solution
splunk-upgrade-latest
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.