Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 449

Export CSV
CVE-2024-45741

Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise

In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a malicious payload through a custom configuration file that the "api.uri" parameter from the "/manager/search/apps/local" endpoint in Splunk Web calls. This could result in execution of unauthorized JavaScript code in the browser of a user.

CVSS 3.1 · 5.4 Medium EPSS 14.8% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform Splunk Enterprise
CVE-2023-22941

Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd).

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2024-23675

Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection Deletion

In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Cloud Splunk
CVE-2024-36985

Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application.

CVSS 3.1 · 8.8 High EPSS 6.5% KEV · Not listed
Vendors
Splunk
Products
Splunk
CVE-2023-22934

SPL Command Safeguards Bypass via the ‘pivot’ SPL Command in Splunk Enterprise

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands using a saved search job. The vulnerability requires an authenticated user to craft the saved job and a higher privileged user to initiate a request within their browser.

CVSS 3.1 · 7.3 High EPSS 1.1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2024-45740

Persistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk Enterprise

In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through Scheduled Views that could result in execution of unauthorized JavaScript code in the browser of a user.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2023-32708

HTTP Response Splitting via the ‘rest’ SPL Command

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the ‘rest’ SPL command that lets them potentially access other REST endpoints in the system arbitrarily.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2023-22932

Persistent Cross-Site Scripting through a Base64-encoded Image in a View in Splunk Enterprise

In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting (XSS) through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2023-32712

Unauthenticated Log Injection in Splunk Enterprise

In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files that, when a vulnerable terminal application reads them, can potentially, at worst, result in possible code execution in the vulnerable application. This attack requires a user to use a terminal application that supports the translation of ANSI escape codes to read the malicious log file locally in the vulnerable terminal, and to perform additional user interaction to exploit. Universal Forwarder versions 9.1.0.1, 9.0.5, 8.2.11, and lower can be vulnerable in situations where they have management services active and accessible over the network. Universal Forwarder versions 9.0.x and 9.1.x bind management services to the local machine and are not vulnerable in this specific configuration. See SVD-2022-0605 for more information. Universal Forwarder versions 9.1 use Unix Domain Sockets (UDS) for communication, which further reduces the potential attack surface. The vulnerability does not directly affect Splunk Enterprise or Universal Forwarder. The indirect impact on Splunk Enterprise and Universal Forwarder can vary significantly depending on the permissions in the vulnerable terminal application and where and how the user reads the malicious log file. For example, users can copy the malicious file from the Splunk Enterprise instance and read it on their local machine.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Universal Forwarder
CVE-2023-32715

Self Cross-Site Scripting (XSS) on Splunk App for Lookup File Editing

In the Splunk App for Lookup File Editing versions below 4.0.1, a user can insert potentially malicious JavaScript code into the app, which causes that code to run on the user’s machine. The app itself does not contain the potentially malicious JavaScript code. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser, and requires additional user interaction to trigger. The attacker cannot exploit the vulnerability at will.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk App For Lookup File Editing
CVE-2023-40593

Denial of Service (DoS) in Splunk Enterprise Using a Malformed SAML Request

In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2023-4571

Unauthenticated Log Injection in Splunk IT Service Intelligence (ITSI)

In Splunk IT Service Intelligence (ITSI) versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject American National Standards Institute (ANSI) escape codes into Splunk ITSI log files that, when a vulnerable terminal application reads them, can run malicious code in the vulnerable application. This attack requires a user to use a terminal application that translates ANSI escape codes to read the malicious log file locally in the vulnerable terminal. The vulnerability also requires additional user interaction to succeed. The vulnerability does not directly affect Splunk ITSI. The indirect impact on Splunk ITSI can vary significantly depending on the permissions in the vulnerable terminal application, as well as where and how the user reads the malicious log file. For example, users can copy the malicious file from Splunk ITSI and read it on their local machine.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
It Service Intelligence
CVE-2024-23677

Server Response Disclosure in RapidDiag Salesforce.com Log File

In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Cloud Splunk
CVE-2024-36995

Low-privileged user could create experimental items

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could create experimental items.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform
CVE-2024-45736

Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon

In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query with an improperly formatted "INGEST_EVAL" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform Splunk Enterprise
CVE-2023-32713

Local Privilege Escalation via the ‘streamfwd’ program in Splunk App for Stream

In Splunk App for Stream versions below 8.1.1, a low-privileged user could use a vulnerability in the streamfwd process within the Splunk App for Stream to escalate their privileges on the machine that runs the Splunk Enterprise instance, up to and including the root user.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk App For Stream
CVE-2024-36986

Risky command safeguards bypass through Search ID query in Analytics Workspace

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safeguards for risky commands in the Analytics Workspace. The vulnerability requires the authenticated user to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Cloud Splunk
CVE-2023-40596

Splunk Enterprise on Windows Privilege Escalation due to Insecure OPENSSLDIR Build Definition Reference in DLL

In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and subsequently install malicious code to achieve privilege escalation on the Windows machine.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft Splunk
Products
Windows Splunk
CVE-2024-29946

Risky command safeguards bypass in Dashboard Examples Hub

In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phish the victim by tricking them into initiating a request within their browser.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Cloud Splunk
CVE-2024-36992

Persistent Cross-site Scripting (XSS) in Dashboard Elements

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that could result in execution of unauthorized JavaScript code in the browser of a user. The “url” parameter of the Dashboard element does not have proper input validation to reject invalid URLs, which could lead to a Persistent Cross-site Scripting (XSS) exploit.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Cloud Platform