Servers and applications
CVE-2017-18348
Splunk Enterprise 6.6.x, when configured to run as root but drop privileges to a specific non-root account, allows local users to gain privileges by leveraging access to that non-root account to modify $SPLUNK_HOME/etc/splunk-launch.conf and insert Trojan horse programs into $SPLUNK_HOME/bin, because the non-root setup instructions state that chown should be run across all of $SPLUNK_HOME to…
- Severity
- High 7.0
- Published
- 19 Oct 2018
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 0.4% in the next 30 daysHigher than 35% of CVEs. EPSS by FIRST, 10 Nov 2026
- Attack
- Needs local access · Only under certain conditions · Needs a user account · No user action needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H- Sources
- NVD
Description
Splunk Enterprise 6.6.x, when configured to run as root but drop privileges to a specific non-root account, allows local users to gain privileges by leveraging access to that non-root account to modify $SPLUNK_HOME/etc/splunk-launch.conf and insert Trojan horse programs into $SPLUNK_HOME/bin, because the non-root setup instructions state that chown should be run across all of $SPLUNK_HOME to give non-root access.
Affected software
| Software | Affected versions |
|---|---|
Splunk EnterpriseServers and applications · cpe:a:splunk:splunk |
|