Skip to content
OpenAdvisories

Product · Splunk

Splunk Cloud Platform

89 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

54 results · Clear filters · Feed

  • Medium 5.4
    CVE-2024-36994

    Persistent Cross-site Scripting (XSS) in Dashboard Elements

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View and Sp…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2024-36989

    Low-privileged user could create notifications in Splunk Web Bulletin Messages

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold the admin or power Splunk roles could create notifications in Splunk Web Bulletin Messages that all us…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2024-36987

    Insecure File Upload in the indexing/preview REST endpoint

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the admin or power Splunk roles could upload a file with an arbitrary extension using t…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2023-32709

    Low-privileged User can View Hashed Default Splunk Password

    In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user’ role can see the hashed version of the initial user name and password for the Splunk instance by u…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2023-32716

    Denial of Service via the 'dump' SPL command

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, an attacker can exploit a vulnerability in the {{dump}} SPL command to cause a denial of service by crashing the Splunk daemon.

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.8
    CVE-2023-32710

    Information Disclosure via the ‘copyresults’ SPL Command

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can perform an unauthorized transfer of data from a search using the ‘copyresults’ command if they know the search I…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2023-32717

    Role-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search Results

    On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the {{/services/indexing/preview}} REST endpoint to overwrite search results if they know the search ID (S…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2023-22938

    Permissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance. The endpoint is now restricted to the ‘splunk-system-user’ account on the local instance.

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2023-22937

    Unnecessary File Extensions Allowed by Lookup Table Uploads in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table upload feature let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now be one of the following only: .csv, .csv.gz, .kmz, .kml, …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.3
    CVE-2023-22936

    Authenticated Blind Server Side Request Forgery via the ‘search_listener’ Search Parameter in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an authenticated user. The initiator of the request cannot see the response without the presenc…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2023-22941 Public exploit

    Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd).

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2023-22931

    ‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions. This feature has been deprecated and disabled by default.

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.3
    CVE-2023-22940

    SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.8
    CVE-2022-32154

    Risky commands warnings in Splunk Enterprise Dashboards

    Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities c…

    Splunk Splunk Enterprise Splunk Cloud Platform