Skip to content
OpenAdvisories

Product · Splunk

Splunk Cloud

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.6
    CVE-2024-23676

    Sensitive Information Disclosure of Index Metrics through “mrollup” SPL Command

    In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.

    Splunk Splunk Enterprise Splunk Cloud
  • Medium 4.3
    CVE-2024-23677

    Server Response Disclosure in RapidDiag Salesforce.com Log File

    In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file.

    Splunk Splunk Enterprise Splunk Cloud
  • Medium 6.5
    CVE-2024-23675

    Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection Deletion

    In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.

    Splunk Splunk Enterprise Splunk Cloud
  • Medium 4.8
    CVE-2023-46213

    Cross-site Scripting (XSS) on “Show Syntax Highlighted” View in Search Page

    In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web browser.

    Splunk Splunk Enterprise Splunk Cloud
  • Medium 6.3
    CVE-2023-40593

    Denial of Service (DoS) in Splunk Enterprise Using a Malformed SAML Request

    In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daem…

    Splunk Splunk Enterprise Splunk Cloud
  • Medium 6.5
    CVE-2023-40594

    Denial of Service (DoS) via the ‘printf’ Search Function

    In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance.

    Splunk Splunk Enterprise Splunk Cloud