Skip to content
OpenAdvisories

Product · Splunk

Splunk Cloud

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.0
    CVE-2023-46214 Public exploit EPSS 89%

    Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing

    In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code exec…

    Splunk Splunk Enterprise Splunk Cloud
  • High 7.8
    CVE-2023-40597

    Absolute Path Traversal in Splunk Enterprise Using runshellscript.py

    In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.

    Splunk Splunk Enterprise Splunk Cloud
  • High 8.4
    CVE-2023-40592

    Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpoint

    In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XSS) on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execu…

    Splunk Splunk Enterprise Splunk Cloud
  • High 8.8
    CVE-2023-40595

    Remote Code Execution via Serialized Session Payload

    In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code.

    Splunk Splunk Enterprise Splunk Cloud
  • High 8.5
    CVE-2023-40598

    Command Injection in Splunk Enterprise Using External Lookups

    In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From the…

    Splunk Splunk Enterprise Splunk Cloud