About randre

randre · ‎12-01-2020

Is it the REST API though ? Like I said I was not able to find documentation about those endpoints. Sounds silly but if you can find it that would great... (and would also be troublesome for me).

randre · ‎11-30-2020

Yeah I checked those and I am fine with them. The problem is that according to a pentest, it publicly exposes config data. So I now need to show that it is actually fine (but not finding docs for that is not helping) or I need to block those URLs. Looks like it is not possible via configuration and I would really like not having to keep a set of rules on the network devices.

randre · ‎11-30-2020

Thanks requireAuthentication defaults to true anyway so it should not fix my issue. And I have to keep acceptFrom * My problem is that I don't find documentation about those endpoints so I am not even sure it's a security issue.

randre · ‎11-25-2020

I have got a pentest results with the following : It was possible to access those endpoints unauthenticated : https://x.x.x.x/en-US/config https://x.x.x.x/en-GB/config https://x.x.x.x/en-US/info https://x.x.x.x/en-US/paths https://x.x.x.x/en-us/lists https://x.x.x.x/en-US/embed Is it really a vulnerability ? They said that it's config data, not public data so it should not be visible. How can we remove those endpoints from being reached unauthenticated ?

Posts	4
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎11-25-2020

Online Status	Offline
Date Last Visited	‎12-01-2020 05:14 PM

Splunk 8.0.0: Sensitive Information disclosure?

Re: Sensitive Information disclosure ? Splunk 8.0....

Re: Sensitive Information disclosure ? Splunk 8.0....

Re: Sensitive Information disclosure ? Splunk 8.0....

Splunk 8.0.0: Sensitive Information disclosure?