CVE-2021-42743: 
Splunk Forwarder vulnerability analysis and mitigation

CVE-2021-42743 is a local privilege escalation vulnerability discovered in Splunk Enterprise Windows installations. The vulnerability, identified as SVD-2022-0501, affects Splunk Enterprise versions before 8.1.1 on Windows systems. It was published on May 3, 2022, and stems from a misconfiguration in the node default path (Splunk Advisory).

The vulnerability has been assigned a CVSSv3.1 base score of 8.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. It is categorized under CWE-427, which relates to uncontrolled search path element vulnerabilities. The technical nature of the flaw involves a misconfiguration in the node default path that can be exploited locally (Splunk Advisory).

The vulnerability allows for local privilege escalation, enabling a lower privileged user to elevate their privileges to that of the Splunk user on affected Windows systems. This could potentially give attackers increased access to system resources and sensitive data (Splunk Advisory).

The vulnerability has been patched in Splunk Enterprise version 8.1.1 and later. Organizations running affected versions are advised to upgrade to version 8.1.1 or later to mitigate this vulnerability. It's worth noting that Splunk Enterprise 8.2 and Splunk Cloud Platform instances are not affected by this vulnerability (Splunk Advisory).