Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 356

Export CSV
CVE-2023-32708

HTTP Response Splitting via the ‘rest’ SPL Command

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the ‘rest’ SPL command that lets them potentially access other REST endpoints in the system arbitrarily.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2023-22932

Persistent Cross-Site Scripting through a Base64-encoded Image in a View in Splunk Enterprise

In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting (XSS) through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2023-32712

Unauthenticated Log Injection in Splunk Enterprise

In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files that, when a vulnerable terminal application reads them, can potentially, at worst, result in possible code execution in the vulnerable application. This attack requires a user to use a terminal application that supports the translation of ANSI escape codes to read the malicious log file locally in the vulnerable terminal, and to perform additional user interaction to exploit. Universal Forwarder versions 9.1.0.1, 9.0.5, 8.2.11, and lower can be vulnerable in situations where they have management services active and accessible over the network. Universal Forwarder versions 9.0.x and 9.1.x bind management services to the local machine and are not vulnerable in this specific configuration. See SVD-2022-0605 for more information. Universal Forwarder versions 9.1 use Unix Domain Sockets (UDS) for communication, which further reduces the potential attack surface. The vulnerability does not directly affect Splunk Enterprise or Universal Forwarder. The indirect impact on Splunk Enterprise and Universal Forwarder can vary significantly depending on the permissions in the vulnerable terminal application and where and how the user reads the malicious log file. For example, users can copy the malicious file from the Splunk Enterprise instance and read it on their local machine.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Universal Forwarder
CVE-2023-32715

Self Cross-Site Scripting (XSS) on Splunk App for Lookup File Editing

In the Splunk App for Lookup File Editing versions below 4.0.1, a user can insert potentially malicious JavaScript code into the app, which causes that code to run on the user’s machine. The app itself does not contain the potentially malicious JavaScript code. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser, and requires additional user interaction to trigger. The attacker cannot exploit the vulnerability at will.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk App For Lookup File Editing
CVE-2023-40593

Denial of Service (DoS) in Splunk Enterprise Using a Malformed SAML Request

In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2024-23677

Server Response Disclosure in RapidDiag Salesforce.com Log File

In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Cloud Splunk
CVE-2024-36995

Low-privileged user could create experimental items

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could create experimental items.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2024-45736

Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon

In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query with an improperly formatted "INGEST_EVAL" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform Splunk Enterprise
CVE-2023-32713

Local Privilege Escalation via the ‘streamfwd’ program in Splunk App for Stream

In Splunk App for Stream versions below 8.1.1, a low-privileged user could use a vulnerability in the streamfwd process within the Splunk App for Stream to escalate their privileges on the machine that runs the Splunk Enterprise instance, up to and including the root user.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk App For Stream
CVE-2024-36986

Risky command safeguards bypass through Search ID query in Analytics Workspace

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safeguards for risky commands in the Analytics Workspace. The vulnerability requires the authenticated user to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Cloud Splunk
CVE-2023-40596

Splunk Enterprise on Windows Privilege Escalation due to Insecure OPENSSLDIR Build Definition Reference in DLL

In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and subsequently install malicious code to achieve privilege escalation on the Windows machine.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft Splunk
Products
Windows Splunk
CVE-2024-29946

Risky command safeguards bypass in Dashboard Examples Hub

In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phish the victim by tricking them into initiating a request within their browser.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Cloud Splunk
CVE-2024-36992

Persistent Cross-site Scripting (XSS) in Dashboard Elements

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that could result in execution of unauthorized JavaScript code in the browser of a user. The “url” parameter of the Dashboard element does not have proper input validation to reject invalid URLs, which could lead to a Persistent Cross-site Scripting (XSS) exploit.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2024-45737

Maintenance mode state change of App Key Value Store (KVStore) through Cross-Site Request Forgery (CSRF)

In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF).

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2024-36989

Low-privileged user could create notifications in Splunk Web Bulletin Messages

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold the admin or power Splunk roles could create notifications in Splunk Web Bulletin Messages that all users on the instance receive.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Cloud Splunk
CVE-2024-45739

Sensitive information disclosure in AdminManager logging channel

In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users. This exposure could happen when you configure the Splunk Enterprise AdminManager log channel at the DEBUG logging level.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk
CVE-2023-32709

Low-privileged User can View Hashed Default Splunk Password

In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user’ role can see the hashed version of the initial user name and password for the Splunk instance by using the ‘rest’ SPL command against the ‘conf-user-seed’ REST endpoint.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2024-45735

Improper Access Control for low-privileged user in Splunk Secure Gateway App

In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the "admin" or "power" Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform Splunk Enterprise and 1 more
CVE-2023-32711

Persistent Cross-Site Scripting (XSS) through a URL Validation Bypass within a Dashboard View

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a Splunk dashboard view lets a low-privileged user exploit a vulnerability in the Bootstrap web framework (CVE-2019-8331) and build a stored cross-site scripting (XSS) payload.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk
CVE-2023-32710

Information Disclosure via the ‘copyresults’ SPL Command

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can perform an unauthorized transfer of data from a search using the ‘copyresults’ command if they know the search ID (SID) of a search job that has recently run.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform