CVE-2023-22940: SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise
First published: Tue Feb 14 2023(Updated: )
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled.
Credit: prodsec@splunk.com prodsec@splunk.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Splunk Splunk | >=8.1.0<8.1.13 | |
| Splunk Splunk | >=8.2.0<8.2.10 | |
| Splunk Splunk | >=9.0.0<9.0.4 | |
| Splunk Splunk Cloud Platform | <9.0.2209.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-22940.
What is the severity level of CVE-2023-22940?
The severity level of CVE-2023-22940 is medium (5.7).
Which versions of Splunk Enterprise are affected by CVE-2023-22940?
Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4 are affected by CVE-2023-22940.
What is the risk associated with CVE-2023-22940?
CVE-2023-22940 could potentially allow for unauthorized access to sensitive information.
How can I fix CVE-2023-22940?
To fix CVE-2023-22940, you should upgrade to Splunk Enterprise versions 8.1.13, 8.2.10, or 9.0.4 or later.
- collector/nvd-index
- agent/author
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/references
- agent/title
- agent/weakness
- agent/tags
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/splunk
- canonical/splunk splunk
- version/splunk splunk/8.1.0
- version/splunk splunk/8.2.0
- version/splunk splunk/9.0.0
- canonical/splunk splunk cloud platform