Splunk Cloud

11 results · Feed

• Medium 4.6
  CVE-2024-23676

  Sensitive Information Disclosure of Index Metrics through “mrollup” SPL Command

  In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.

  Splunk Splunk Enterprise Splunk Cloud
  Jan 22, 2024
• Medium 4.3
  CVE-2024-23677

  Server Response Disclosure in RapidDiag Salesforce.com Log File

  In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file.

  Splunk Splunk Enterprise Splunk Cloud
  Jan 22, 2024
• Medium 6.5
  CVE-2024-23675

  Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection Deletion

  In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.

  Splunk Splunk Enterprise Splunk Cloud
  Jan 22, 2024
• Medium 4.8
  CVE-2023-46213

  Cross-site Scripting (XSS) on “Show Syntax Highlighted” View in Search Page

  In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web browser.

  Splunk Splunk Enterprise Splunk Cloud
  Nov 16, 2023
• High 8.0
  CVE-2023-46214 Public exploit EPSS 89%

  Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing

  In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code exec…

  Splunk Splunk Enterprise Splunk Cloud
  Nov 16, 2023
• High 7.8
  CVE-2023-40597

  Absolute Path Traversal in Splunk Enterprise Using runshellscript.py

  In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.

  Splunk Splunk Enterprise Splunk Cloud
  Aug 30, 2023
• Medium 6.3
  CVE-2023-40593

  Denial of Service (DoS) in Splunk Enterprise Using a Malformed SAML Request

  In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daem…

  Splunk Splunk Enterprise Splunk Cloud
  Aug 30, 2023
• Medium 6.5
  CVE-2023-40594

  Denial of Service (DoS) via the ‘printf’ Search Function

  In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance.

  Splunk Splunk Enterprise Splunk Cloud
  Aug 30, 2023
• High 8.4
  CVE-2023-40592

  Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpoint

  In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XSS) on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execu…

  Splunk Splunk Enterprise Splunk Cloud
  Aug 30, 2023
• High 8.8
  CVE-2023-40595

  Remote Code Execution via Serialized Session Payload

  In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code.

  Splunk Splunk Enterprise Splunk Cloud
  Aug 30, 2023
• High 8.5
  CVE-2023-40598

  Command Injection in Splunk Enterprise Using External Lookups

  In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From the…

  Splunk Splunk Enterprise Splunk Cloud
  Aug 30, 2023