Vulnerability record · CVE-2018-11409 · published 8 June 2018
CVE-2018-11409: Splunk server-info endpoint exposes sensitive data without authentication
Splunk · Splunk
Splunk through 7.0.1 allows unauthenticated information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, which returns server details including the license key. Because the endpoint is reachable over the network with no credentials, any party who can reach the Splunk web interface can pull sensitive configuration data.
Description
Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Automated analysis
high priorityUnauthenticated remote disclosure of sensitive server data with public exploit code and very high EPSS, though impact is limited to confidentiality.
What it is
Splunk through 7.0.1 allows unauthenticated information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, which returns server details including the license key. Because the endpoint is reachable over the network with no credentials, any party who can reach the Splunk web interface can pull sensitive configuration data.
Impact
An attacker gains read access to server information such as the Splunk license key, which can aid further targeting or abuse of the deployment. The flaw is confidentiality-only; no integrity or availability impact is described.
Attack surface
Reached over the network via the Splunk web/HTTP interface by requesting the crafted __raw path; the CVSS vector shows no privileges required and no user interaction, so it is unauthenticated and remotely triggerable.
Exploitation
Public exploit code exists (Exploit-DB 44865 and a GitHub PoC), and EPSS is very high at roughly 98% 30-day probability, though the CVE is not listed in CISA KEV.
What to do
- Upgrade Splunk to a version later than 7.0.1, which is the last version named as affected.
- Restrict network access to the Splunk web interface to trusted management networks only.
- Require authentication and enforce least-privilege roles for all Splunk HTTP endpoints.
- Monitor and rotate the Splunk license key if exposure is suspected.
Detection
- Search Splunk or web proxy logs for requests containing __raw/services/server/info/server-info.
- Alert on unauthenticated access to /services/server/info paths from unexpected source IPs.
- Baseline normal callers of the server-info endpoint and flag new or external sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securitytracker.com/id/1041148 | Third Party AdvisoryVDB Entry |
| https://github.com/kofa2002/splunk | ExploitThird Party Advisory |
| https://www.exploit-db.com/exploits/44865/ | ExploitThird Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1041148 | Third Party AdvisoryVDB Entry |
| https://github.com/kofa2002/splunk | ExploitThird Party Advisory |
| https://www.exploit-db.com/exploits/44865/ | ExploitThird Party AdvisoryVDB Entry |
Track CVE-2018-11409 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-11409), CISA KEV, FIRST EPSS (scores of 2026-09-22). This page is refreshed as NVD updates the record.
