Skip to content
OpenAdvisories

Vendor

Splunk

347 known vulnerabilities.

Products

Splunk Enterprise 259 Splunk Cloud Platform 89 Splunk SOAR 31 Splunk Secure Gateway 20 Splunk AI Toolkit 12 Splunk Cloud 11 Splunk Enterprise Cloud 5 Splunk Connect for Kafka 4 Splunk Light 4 Splunk Add-on Builder 3 AD LDAP app for Splunk SOAR 3 Splunk App for Lookup File Editing 3 Splunk MCP Server 3 Universal Forwarder 3 Splunk Enterprise Security (ES) 2 Cisco Talos Intelligence for Enterprise Security Cloud 2 Splunk Enterprise Security 2 Zoom app for Splunk SOAR 1 Splunk App for SOAR 1 Splunk/UniversalForwarder for Windows 1 Splunk Add-on for Palo Alto Networks 1 Splunk Supporting Add-on for Active Directory 1 Splunk CloudConnect SDK 1 Splunk App for Stream 1 AWS IAM app for Splunk SOAR 1 Universal Forwarders 1 Splunk On-Call (VictorOps) 1 Cisco Webex app for Splunk SOAR 1 MS Graph for Active Directory app for Splunk SOAR 1 RSA SecurID Authentication Manager app for Splunk SOAR 1 Splunk MCP Server app 1 Nmap Scanner 1 Splunk Attack Analyzer Connector for Splunk SOAR 1 Splunk SOAR (On-premises) 1 Venafi app for Splunk SOAR 1 Splunk SOAR (Cloud) 1 Cisco Secure Malware Analytics app for Splunk SOAR 1 CrowdStrike OAuth API app for Splunk SOAR 1 Splunk ITSI 1 FireAMP 1
All Critical High Medium Low Exploited only Public exploit

183 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-20321

    Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and 9.2.2406.119, an unauthenticated attacker can send a specially-crafted SPL search that could change the membership sta…

    Splunk Splunk Enterprise Splunk Enterprise Cloud
  • Medium 4.3
    CVE-2025-20323

    Missing Access Control of Saved Searches in the Splunk Archiver app

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could turn off the scheduled search `Bucket Copy Trigger` within the Splunk Archiver application. This is because…

    Splunk Splunk Enterprise
  • Medium 6.8
    CVE-2025-20319

    Remote Command Execution through Scripted Input Files in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a user who holds a role that contains the high-privilege capability `edit_scripted` and `list_inputs` capability , could perform a remote command execution due to improper user input sanitiz…

    Splunk Splunk Enterprise
  • Medium 5.4
    CVE-2025-20324

    Improper Access Control in System Source Types Configuration in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create or overwrite […

    Splunk Splunk Enterprise Splunk Enterprise Cloud
  • Medium 6.3
    CVE-2025-20320

    Denial of Service (DoS) through “User Interface - Views“ configuration page in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious pay…

    Splunk Splunk Enterprise Splunk Enterprise Cloud
  • Medium 4.3
    CVE-2025-20300

    Improper Access Control Lets Low-Privilege Users Suppress Read-Only Alerts in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.6, and 9.1.9 and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles, and has read-only access to…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2025-20297 EPSS 34%

    Reflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation component

    In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload thro…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2025-20230

    Missing Access Control and Incorrect Ownership of Data in App Key Value Store (KVStore) collections in the Splunk Secure Gateway App

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could edit and del…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Medium 5.7
    CVE-2025-20232

    Risky Command Safeguards Bypass in “/app/search/search“ endpoint through “s“ parameter in Splunk Enterprise

    In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208 and 9.1.2308.212, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could ru…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2025-20228

    Maintenance mode state change of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise

    In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Ke…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2025-20227

    Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard Studio

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.7
    CVE-2025-20226

    Risky command safeguards bypass in “/services/streams/search“ endpoint through “q“ parameter in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a saved search wit…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2025-0367

    Regular Expression Denial of Service (ReDoS) in Splunk Supporting Add-on for Active Directory (SA-ldapsearch)

    In versions 3.1.0 and lower of the Splunk Supporting Add-on for Active Directory, also known as SA-ldapsearch, a vulnerable regular expression pattern could lead to a Regular Expression Denial of Service (ReDoS) attack.

    Splunk Splunk Supporting Add-on for Active Directory
  • Medium 6.4
    CVE-2025-22621

    Privilege escalation for users who hold the “splunk_app_soar“ role in the Splunk App for SOAR

    In versions 1.0.67 and lower of the Splunk App for SOAR, the Splunk documentation for that app recommended adding the `admin_all_objects` capability to the `splunk_app_soar` role. This addition could lead to improper access control for a low-privileged user t…

    Splunk Splunk App for SOAR
  • Medium 5.7
    CVE-2024-53244

    Risky command safeguards bypass in “/en-US/app/search/report“ endpoint through “s“ parameter

    In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.2.2406.107, 9.2.2403.109, and 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a ris…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.3
    CVE-2024-53246

    Sensitive Information Disclosure through SPL commands

    In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.111, and 9.1.2312.206, an SPL command can potentially disclose sensitive information. The vulnerability requires the expl…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2024-53243

    Information Disclosure in Mobile Alert Responses in Splunk Secure Gateway

    In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and versions below 3.2.462, 3.7.18, and 3.8.5 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could see alert s…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Medium 4.9
    CVE-2024-45738

    Sensitive information disclosure in REST_Calls logging channel

    In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure could happen if you configure the Splunk Enterprise `REST_Calls` log channel at the DEBUG logging l…

    Splunk Splunk Enterprise
  • Medium 4.9
    CVE-2024-45739

    Sensitive information disclosure in AdminManager logging channel

    In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users. This exposure could happen when you configure the Splunk Enterprise AdminManager log channel at the…

    Splunk Splunk Enterprise
  • Medium 4.3
    CVE-2024-45737

    Maintenance mode state change of App Key Value Store (KVStore) through Cross-Site Request Forgery (CSRF)

    In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Ke…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2024-45736

    Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon

    In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query with an …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2024-45741 EPSS 15%

    Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise

    In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a malicious payload through a custom configur…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2024-45734

    Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard

    In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The …

    Splunk Splunk Enterprise
  • Medium 5.4
    CVE-2024-45740

    Persistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk Enterprise

    In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through Scheduled Views that could result in ex…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2024-45735

    Improper Access Control for low-privileged user in Splunk Secure Gateway App

    In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the "admin" or "power" Splunk roles can see App Key Value Stor…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Medium 4.6
    CVE-2024-36997

    Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in the browser context of another Splunk user through the conf-web/settings REST en…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2024-36993

    Persistent Cross-site Scripting (XSS) in Web Bulletin

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a Splunk Web …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2024-36995

    Low-privileged user could create experimental items

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could create experimental items.

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2024-36990

    Denial of Service (DoS) on the datamodel/web REST endpoint

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an authenticated, low-privileged user that does not hold the admin or power Splunk roles could send a specially crafted HTTP POST request to th…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2024-36992

    Persistent Cross-site Scripting (XSS) in Dashboard Elements

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that c…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.3
    CVE-2024-36986

    Risky command safeguards bypass through Search ID query in Analytics Workspace

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safeguards for …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.3
    CVE-2024-36996

    Information Disclosure of user names

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2024-36994

    Persistent Cross-site Scripting (XSS) in Dashboard Elements

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View and Sp…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2024-36989

    Low-privileged user could create notifications in Splunk Web Bulletin Messages

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold the admin or power Splunk roles could create notifications in Splunk Web Bulletin Messages that all us…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2024-36987

    Insecure File Upload in the indexing/preview REST endpoint

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the admin or power Splunk roles could upload a file with an arbitrary extension using t…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.6
    CVE-2024-23676

    Sensitive Information Disclosure of Index Metrics through “mrollup” SPL Command

    In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.

    Splunk Splunk Enterprise Splunk Cloud
  • Medium 4.3
    CVE-2024-23677

    Server Response Disclosure in RapidDiag Salesforce.com Log File

    In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file.

    Splunk Splunk Enterprise Splunk Cloud
  • Medium 6.5
    CVE-2024-23675

    Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection Deletion

    In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.

    Splunk Splunk Enterprise Splunk Cloud
  • Medium 4.3
    CVE-2024-22164

    Denial of Service of an Investigation in Splunk Enterprise Security through Investigation attachments

    In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation. The attachment endpoint does not properly limit the size of the request which lets an attacker ca…

    Splunk Splunk Enterprise Security (ES)
  • Medium 6.5
    CVE-2024-22165

    Denial of Service in Splunk Enterprise Security of the Investigations manager through Investigation creation

    In Splunk Enterprise Security (ES) versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service (DoS). The malformed investigation prevents the generation and rendering of the Investigations manager until it is de…

    Splunk Splunk Enterprise Security (ES)