CVE-2023-22940

· MEDIUMModified

← All CVEs

CVSS v3.1

6.3

EPSS

0.43%

Published

Feb 14, 2023

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Weaknesses (CWE)

CWE-20

Affected Products (4)

splunk · splunk (up to 8.1.13)vulnerable

splunk · splunk (up to 8.2.10)vulnerable

splunk · splunk (up to 9.0.4)vulnerable

splunk · splunk_cloud_platform (up to 9.0.2209.3)vulnerable

References (4)

https://advisory.splunk.com/advisories/SVD-2023-0210

Vendor Advisory