CVE-2017-17067
CriticalSummary
Splunk Web in Splunk Enterprise versions 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and 6.3.x before 6.3.12, when SAML authType is enabled, mishandles SAML, allowing remote attackers to bypass intended access restrictions or conduct impersonation attacks.
Risk Assessment
The organization may be exposed to unauthorized access to systems and data, potentially leading to serious security breaches.
Recommendation
It is recommended to update Splunk Enterprise to the latest version to mitigate this vulnerability and to review the SAML authentication configuration.
Original NVD description (English source)
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and 6.3.x before 6.3.12, when the SAML authType is enabled, mishandles SAML, which allows remote attackers to bypass intended access restrictions or conduct impersonation attacks.