CWE Code: 732
Vulnerability Type: privilege_escalation
CVSS Score: 6.9
CWE Name:  Incorrect Permission Assignment for Critical Resource
Summary: splunk enterprise 6.6.x, when configured to run as root but drop privileges to a specific non-root account, allows local users to gain privileges by leveraging access to that non-root account to modify $splunk_home/etc/splunk-launch.conf and insert trojan horse programs into $splunk_home/bin, because the non-root setup instructions state that chown should be run across all of $splunk_home to give non-root access.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2018-10-19
Last Modified Date: 2019-10-03