Skip to content
OpenAdvisories

Vendor

Splunk

347 known vulnerabilities.

Products

Splunk Enterprise 259 Splunk Cloud Platform 89 Splunk SOAR 31 Splunk Secure Gateway 20 Splunk AI Toolkit 12 Splunk Cloud 11 Splunk Enterprise Cloud 5 Splunk Connect for Kafka 4 Splunk Light 4 Splunk Add-on Builder 3 AD LDAP app for Splunk SOAR 3 Splunk App for Lookup File Editing 3 Splunk MCP Server 3 Universal Forwarder 3 Splunk Enterprise Security (ES) 2 Cisco Talos Intelligence for Enterprise Security Cloud 2 Splunk Enterprise Security 2 Zoom app for Splunk SOAR 1 Splunk App for SOAR 1 Splunk/UniversalForwarder for Windows 1 Splunk Add-on for Palo Alto Networks 1 Splunk Supporting Add-on for Active Directory 1 Splunk CloudConnect SDK 1 Splunk App for Stream 1 AWS IAM app for Splunk SOAR 1 Universal Forwarders 1 Splunk On-Call (VictorOps) 1 Cisco Webex app for Splunk SOAR 1 MS Graph for Active Directory app for Splunk SOAR 1 RSA SecurID Authentication Manager app for Splunk SOAR 1 Splunk MCP Server app 1 Nmap Scanner 1 Splunk Attack Analyzer Connector for Splunk SOAR 1 Splunk SOAR (On-premises) 1 Venafi app for Splunk SOAR 1 Splunk SOAR (Cloud) 1 Cisco Secure Malware Analytics app for Splunk SOAR 1 CrowdStrike OAuth API app for Splunk SOAR 1 Splunk ITSI 1 FireAMP 1
All Critical High Medium Low Exploited only Public exploit

183 results · Clear filters · Feed

  • Medium 4.8
    CVE-2023-46213

    Cross-site Scripting (XSS) on “Show Syntax Highlighted” View in Search Page

    In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web browser.

    Splunk Splunk Enterprise Splunk Cloud
  • Medium 6.3
    CVE-2023-40593

    Denial of Service (DoS) in Splunk Enterprise Using a Malformed SAML Request

    In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daem…

    Splunk Splunk Enterprise Splunk Cloud
  • Medium 6.5
    CVE-2023-40594

    Denial of Service (DoS) via the ‘printf’ Search Function

    In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance.

    Splunk Splunk Enterprise Splunk Cloud
  • Medium 4.3
    CVE-2023-32709

    Low-privileged User can View Hashed Default Splunk Password

    In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user’ role can see the hashed version of the initial user name and password for the Splunk instance by u…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2023-32716

    Denial of Service via the 'dump' SPL command

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, an attacker can exploit a vulnerability in the {{dump}} SPL command to cause a denial of service by crashing the Splunk daemon.

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.8
    CVE-2023-32710

    Information Disclosure via the ‘copyresults’ SPL Command

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can perform an unauthorized transfer of data from a search using the ‘copyresults’ command if they know the search I…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2023-32717

    Role-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search Results

    On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the {{/services/indexing/preview}} REST endpoint to overwrite search results if they know the search ID (S…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.7
    CVE-2023-32715

    Self Cross-Site Scripting (XSS) on Splunk App for Lookup File Editing

    In the Splunk App for Lookup File Editing versions below 4.0.1, a user can insert potentially malicious JavaScript code into the app, which causes that code to run on the user’s machine. The app itself does not contain the potentially malicious JavaScript cod…

    Splunk Splunk App for Lookup File Editing
  • Medium 5.4
    CVE-2023-32711

    Persistent Cross-Site Scripting (XSS) through a URL Validation Bypass within a Dashboard View

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a Splunk dashboard view lets a low-privileged user exploit a vulnerability in the Bootstrap web framework (CVE-2019-8331) and build a stored cross-site scripting (XSS) payload.

    Splunk Splunk Enterprise
  • Medium 4.3
    CVE-2023-22938

    Permissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance. The endpoint is now restricted to the ‘splunk-system-user’ account on the local instance.

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2023-22937

    Unnecessary File Extensions Allowed by Lookup Table Uploads in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table upload feature let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now be one of the following only: .csv, .csv.gz, .kmz, .kml, …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.8
    CVE-2023-22943

    Modular Input REST API Requests Connect via HTTP after Certificate Validation Failure in Splunk Add-on Builder and Splunk CloudConnect SDK

    In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connect over HTTPS occurs.

    Splunk Splunk Add-on Builder Splunk CloudConnect SDK
  • Medium 5.4
    CVE-2023-22942

    Cross-Site Request Forgery in the ‘ssg/kvstore_client’ REST Endpoint in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a potential attacker update SSG KV store collections using an HTTP GET request.

    Splunk Splunk Enterprise
  • Medium 6.3
    CVE-2023-22936

    Authenticated Blind Server Side Request Forgery via the ‘search_listener’ Search Parameter in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an authenticated user. The initiator of the request cannot see the response without the presenc…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2023-22941 Public exploit

    Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd).

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2023-22931

    ‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions. This feature has been deprecated and disabled by default.

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.3
    CVE-2023-22940

    SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.9
    CVE-2022-43564

    Denial of Service in Splunk Enterprise through search macros

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user who can create search macros and schedule search reports can cause a denial of service through the use of specially crafted search macros.

    Splunk Splunk Enterprise
  • Medium 6.4
    CVE-2022-43561

    Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts that can lead to persistent cross-site scripting (XSS). The vulnerability affects instances with Splunk Web enabled.

    Splunk Splunk Enterprise
  • Medium 5.5
    CVE-2022-37439

    Malformed ZIP file crashes Universal Forwarders and Splunk Enterprise through file monitoring input

    In Splunk Enterprise and Universal Forwarder versions in the following table, indexing a specially crafted ZIP file using the file monitoring input can result in a crash of the application. Attempts to restart the application would result in a crash and would…

    Splunk Splunk Enterprise Universal Forwarders
  • Medium 6.8
    CVE-2022-32154

    Risky commands warnings in Splunk Enterprise Dashboards

    Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities c…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2022-26070

    Error message discloses internal path

    When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. The vulnerability impacts Splunk Enterprise versions before 8.1.0.

    Splunk Splunk Enterprise
  • Medium 5.3
    CVE-2021-33845

    Username enumeration through lockout message in REST API

    The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors.

    Splunk Splunk Enterprise