Skip to content
OpenAdvisories

Vendor

Splunk

347 known vulnerabilities.

Products

Splunk Enterprise 259 Splunk Cloud Platform 89 Splunk SOAR 31 Splunk Secure Gateway 20 Splunk AI Toolkit 12 Splunk Cloud 11 Splunk Enterprise Cloud 5 Splunk Connect for Kafka 4 Splunk Light 4 Splunk Add-on Builder 3 AD LDAP app for Splunk SOAR 3 Splunk App for Lookup File Editing 3 Splunk MCP Server 3 Universal Forwarder 3 Splunk Enterprise Security (ES) 2 Cisco Talos Intelligence for Enterprise Security Cloud 2 Splunk Enterprise Security 2 Zoom app for Splunk SOAR 1 Splunk App for SOAR 1 Splunk/UniversalForwarder for Windows 1 Splunk Add-on for Palo Alto Networks 1 Splunk Supporting Add-on for Active Directory 1 Splunk CloudConnect SDK 1 Splunk App for Stream 1 AWS IAM app for Splunk SOAR 1 Universal Forwarders 1 Splunk On-Call (VictorOps) 1 Cisco Webex app for Splunk SOAR 1 MS Graph for Active Directory app for Splunk SOAR 1 RSA SecurID Authentication Manager app for Splunk SOAR 1 Splunk MCP Server app 1 Nmap Scanner 1 Splunk Attack Analyzer Connector for Splunk SOAR 1 Splunk SOAR (On-premises) 1 Venafi app for Splunk SOAR 1 Splunk SOAR (Cloud) 1 Cisco Secure Malware Analytics app for Splunk SOAR 1 CrowdStrike OAuth API app for Splunk SOAR 1 Splunk ITSI 1 FireAMP 1
All Critical High Medium Low Exploited only Public exploit

347 results · Feed

  • High 8.1
    CVE-2022-43563

    Risky command safeguards bypass via rex search command field names in Splunk Enterprise

    In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the rex search command handles field names lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulne…

    Splunk Splunk Enterprise
  • Low 3.0
    CVE-2022-43562

    Host Header Injection in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote authenticated user conduct various attacks against the system, including cross-site scripting and c…

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2022-43571 Public exploit EPSS 19%

    Remote Code Execution through dashboard PDF generation component in Splunk Enterprise

    In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.

    Splunk Splunk Enterprise
  • Medium 6.4
    CVE-2022-43561

    Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts that can lead to persistent cross-site scripting (XSS). The vulnerability affects instances with Splunk Web enabled.

    Splunk Splunk Enterprise
  • High 7.4
    CVE-2022-37437

    Ingest Actions UI in Splunk Enterprise 9.0.0 disabled TLS certificate validation

    When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service (S3) in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Spl…

    Splunk Splunk Enterprise
  • Medium 5.5
    CVE-2022-37439

    Malformed ZIP file crashes Universal Forwarders and Splunk Enterprise through file monitoring input

    In Splunk Enterprise and Universal Forwarder versions in the following table, indexing a specially crafted ZIP file using the file monitoring input can result in a crash of the application. Attempts to restart the application would result in a crash and would…

    Splunk Splunk Enterprise Universal Forwarders
  • Low 2.6
    CVE-2022-37438

    Information disclosure via the dashboard drilldown in Splunk Enterprise

    In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information (for example, username, email, and real name) about Splunk users, when visited by another user through the drilldown comp…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Critical 9.0
    CVE-2022-32158

    Splunk Enterprise deployment servers allow client publishing of forwarder bundles

    Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulner…

    Splunk Splunk Enterprise
  • High 7.5
    CVE-2022-32157

    Splunk Enterprise deployment servers allow unauthenticated forwarder bundle downloads

    Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients (https:…

    Splunk Splunk Enterprise
  • Unscored —
    CVE-2022-32155

    Universal Forwarder management services allows remote login by default

    In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity speci…

    Splunk Universal Forwarder
  • Medium 6.8
    CVE-2022-32154

    Risky commands warnings in Splunk Enterprise Dashboards

    Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities c…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 8.1
    CVE-2022-32153

    Splunk Enterprise lacked TLS host name validation

    Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with va…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 8.1
    CVE-2022-32152

    Splunk Enterprise lacked TLS cert validation for Splunk-to-Splunk communication by default

    Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with va…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.4
    CVE-2022-32151

    Splunk Enterprise disabled TLS validation using the CA certificate stores in Python 3 libraries by default

    The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions bef…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 8.1
    CVE-2022-32156

    Splunk Enterprise and Universal Forwarder CLI connections lacked TLS cert validation

    In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface (CLI) did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host…

    Splunk Splunk Enterprise Universal Forwarder
  • High 8.8
    CVE-2022-27183

    Reflected XSS in a query parameter of the Monitoring Console

    The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, an…

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2022-26889

    Path Traversal in search parameter results in external content injection

    In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page (e.g., HTML Injection, XSS) or bypass SPL s…

    Splunk Splunk Enterprise
  • Medium 4.3
    CVE-2022-26070

    Error message discloses internal path

    When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. The vulnerability impacts Splunk Enterprise versions before 8.1.0.

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2021-42743

    Local privilege escalation via a default path in Splunk Enterprise Windows

    A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions before 8.1.1 on Windows.

    Splunk Splunk Enterprise
  • Medium 5.3
    CVE-2021-33845

    Username enumeration through lockout message in REST API

    The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors.

    Splunk Splunk Enterprise
  • High 7.5
    CVE-2021-31559

    S2S TcpToken authentication bypass

    A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impa…

    Splunk Splunk Enterprise
  • High 8.1
    CVE-2021-26253

    Bypass of Splunk Enterprise's implementation of DUO MFA

    A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6. The potential vulnerability impacts Splunk Enterprise instances configured to use DUO MFA and does…

    Splunk Splunk Enterprise
  • High 7.5
    CVE-2021-3422

    Indexer denial-of-service via malformed S2S request

    The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 …

    Splunk Splunk Enterprise
  • Unscored —
    CVE-2016-4858

    Cross-site scripting vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, S…

    Splunk Splunk Enterprise Splunk Light
  • Unscored —
    CVE-2016-4857

    Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk E…

    Splunk Splunk Enterprise Splunk Light
  • Unscored —
    CVE-2016-4859

    Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk E…

    Splunk Splunk Enterprise Splunk Light
  • Unscored —
    CVE-2016-4856

    Cross-site scripting vulnerability in Splunk Enterprise 6.3.x prior to 6.3.5 and Splunk Light 6.3.x prior to 6.3.5 allo…

    Splunk Splunk Enterprise Splunk Light