CVE-2023-32709

Low-privileged User can View Hashed Default Splunk Password

State: Published
Severity: 4.3 Medium
Published: Jun 1, 2023
Updated: Feb 28, 2025
Reserved: May 11, 2023

Description

In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user’ role can see the hashed version of the initial user name and password for the Splunk instance by using the ‘rest’ SPL command against the ‘conf-user-seed’ REST endpoint.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	Splunk

Weaknesses

CWE-285 The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	8.1 to before 8.1.14Affected 8.2 to before 8.2.11Affected 9.0 to before 9.0.5Affected
Splunk Cloud PlatformSplunk	- to before 9.0.2303.100Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.