8.1
CWE
77 20
Advisory Published
Updated

CVE-2022-32154: Risky commands warnings in Splunk Enterprise Dashboards

First published: Wed Jun 15 2022(Updated: )

Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) for more information. Note that the attack is browser-based and an attacker cannot exploit it at will.

Credit: prodsec@splunk.com

Affected SoftwareAffected VersionHow to fix
Splunk Splunk<9.0
Splunk Splunk Cloud Platform<8.2.2106

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is CVE-2022-32154?

    CVE-2022-32154 is a vulnerability in Splunk Enterprise versions before 9.0 that allows an attacker to inject risky search commands into a form token, bypassing SPL safeguards.

  • What is the severity of CVE-2022-32154?

    The severity of CVE-2022-32154 is high with a CVSS score of 8.1.

  • Which versions of Splunk Enterprise are affected by CVE-2022-32154?

    Splunk Enterprise versions before 9.0 are affected by CVE-2022-32154.

  • How can an attacker exploit CVE-2022-32154?

    An attacker can exploit CVE-2022-32154 by injecting risky search commands into a form token used in a query in a cross-origin request.

  • How can I mitigate CVE-2022-32154?

    To mitigate CVE-2022-32154, it is recommended to upgrade to Splunk Enterprise version 9.0 or later.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203