CVE-2023-22940: SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-22940.
What is the severity level of CVE-2023-22940?
The severity level of CVE-2023-22940 is medium (5.7).
Which versions of Splunk Enterprise are affected by CVE-2023-22940?
Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4 are affected by CVE-2023-22940.
What is the risk associated with CVE-2023-22940?
CVE-2023-22940 could potentially allow for unauthorized access to sensitive information.
How can I fix CVE-2023-22940?
To fix CVE-2023-22940, you should upgrade to Splunk Enterprise versions 8.1.13, 8.2.10, or 9.0.4 or later.