Splunk Universal Forwarder for Windows Incorrect Permission Vulnerability

A vulnerability exists in Splunk Universal Forwarder for Windows in versions prior to 9.4.2, 9.3.4, 9.2.6, and 9.1.9. During a new installation or an upgrade to an affected version, incorrect permissions can be assigned in the default installation directory. This misconfiguration allows non-administrator users to access the directory and its contents.

Impact

The vulnerability allows non-administrator users to access the Universal Forwarder installation directory and all its contents, potentially leading to unauthorized data access or modification.

Remediation

Users can upgrade Splunk Universal Forwarder for Windows to versions 9.4.2, 9.3.4, 9.2.6, 9.1.9, or higher. If an upgrade is not possible, the vulnerability can be mitigated by running a command to remove group permissions for non-administrator users from the installation directory. This command can be executed as a Windows system administrator using Command Prompt or PowerShell.