CVE-2023-22940
14.02.2023, 18:15
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the collect search processing language (SPL) command, including summaryindex, sumindex, stash, mcollect, and meventcollect, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled.Enginsight
| Vendor | Product | Version |
|---|---|---|
| splunk | splunk | 8.1.0 ≤ 𝑥 < 8.1.13 |
| splunk | splunk | 8.2.0 ≤ 𝑥 < 8.2.10 |
| splunk | splunk | 9.0.0 ≤ 𝑥 < 9.0.4 |
| splunk | splunk_cloud_platform | 𝑥 < 9.0.2209.3 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration