title: Sensitive Information Disclosure of Index Metrics through “mrollup” SPL Command
description: In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.
problem types: The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.
affected:
{
product: Splunk Enterprise
vendor: Splunk
versions:
version: 9.0, status: affected, versionType: custom, lessThan: 9.0.8
version: 9.1, status: affected, versionType: custom, lessThan: 9.1.3
}
{
product: Splunk Cloud
vendor: Splunk
versions:
version: -, status: affected, versionType: custom, lessThan: 9.1.2308.200
}
metrics:
cvssV3_1: [
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
baseScore: 4.6
baseSeverity: MEDIUM
]
format: CVSS
scenarios: GENERAL