CVE-2011-4643: Multiple directory traversal vulnerabilities in Splunk 4.x before 4.2.5 allow remote authenticated users to...

Security readout for executives and security teams

This flaw lets a logged-in remote user read files they should not be able to access from affected Splunk systems. Because Splunk often stores operational and security data, unintended file disclosure could expose sensitive configuration or monitoring information. The available record names Splunk 4.x before 4.2.5. Exposure is limited to organizations still running Splunk 4.x before 4.2.5, especially where Splunk Web or Splunkd HTTP Server is reachable by authenticated non-admin users. The public source bundle does not identify affected CPEs, deployment defaults, or unauthenticated exposure. Prioritize remediation if any legacy Splunk 4.x instance remains in production. The issue is old, authenticated, and not KEV-listed, but arbitrary file read on a security platform can expose sensitive operational data. Mitigation focus: Upgrade affected Splunk 4.x deployments to 4.2.5 or later.; Review Splunk vendor guidance for SPL-45243 before applying compensating controls.; Restrict Splunk Web and Splunkd HTTP access to trusted administrative networks..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.