Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 356

Export CSV
CVE-2023-32717

Role-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search Results

On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the {{/services/indexing/preview}} REST endpoint to overwrite search results if they know the search ID (SID) of an existing search job.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2024-45732

Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app

In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform Splunk Enterprise
CVE-2024-36997

Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in the browser context of another Splunk user through the conf-web/settings REST endpoint. This could potentially cause a persistent cross-site scripting (XSS) exploit.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2023-22936

Authenticated Blind Server Side Request Forgery via the ‘search_listener’ Search Parameter in Splunk Enterprise

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an authenticated user. The initiator of the request cannot see the response without the presence of an additional vulnerability within the environment.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2024-36994

Persistent Cross-site Scripting (XSS) in Dashboard Elements

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View and Splunk Web Bulletin Messages that could result in execution of unauthorized JavaScript code in the browser of a user.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2023-40595

Remote Code Execution via Serialized Session Payload

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2023-40592

Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpoint

In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XSS) on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk platform instance.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2024-36991

Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows

In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

CVSS 3.1 · 7.5 High EPSS 13.0% KEV · Not listed
Vendors
Microsoft Splunk
Products
Windows Splunk
CVE-2024-36982

Denial of Service through null pointer reference in “cluster/config” REST endpoint

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash of the Splunk daemon.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Cloud Splunk Splunk Cloud Platform and 1 more
CVE-2024-45738

Sensitive information disclosure in REST_Calls logging channel

In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure could happen if you configure the Splunk Enterprise `REST_Calls` log channel at the DEBUG logging level.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk
CVE-2023-22939

SPL Command Safeguards Bypass via the ‘map’ SPL Command in Splunk Enterprise

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects instances with Splunk Web enabled.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2023-40594

Denial of Service (DoS) via the ‘printf’ Search Function

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2024-45731

Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk

In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft Splunk
Products
Windows Splunk Splunk Enterprise
CVE-2023-22940

SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2024-45733

Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows

In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Microsoft Splunk
Products
Windows Splunk Splunk Enterprise
CVE-2023-22931

‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk Enterprise

In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions. This feature has been deprecated and disabled by default.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2024-36987

Insecure File Upload in the indexing/preview REST endpoint

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the admin or power Splunk roles could upload a file with an arbitrary extension using the indexing/preview REST endpoint.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Cloud Splunk
CVE-2023-22942

Cross-Site Request Forgery in the ‘ssg/kvstore_client’ REST Endpoint in Splunk Enterprise

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a potential attacker update SSG KV store collections using an HTTP GET request.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk
CVE-2023-32716

Denial of Service via the 'dump' SPL command

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, an attacker can exploit a vulnerability in the {{dump}} SPL command to cause a denial of service by crashing the Splunk daemon.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2024-36990

Denial of Service (DoS) on the datamodel/web REST endpoint

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an authenticated, low-privileged user that does not hold the admin or power Splunk roles could send a specially crafted HTTP POST request to the datamodel/web REST endpoint in Splunk Enterprise, potentially causing a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform