In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cloud | Splunk | * | 9.1.2308.200 (excluding) |
| Splunk | Splunk | 9.0.0 (including) | 9.0.8 (excluding) |
| Splunk | Splunk | 9.1.0 (including) | 9.1.3 (excluding) |