CVE-2023-22940
The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access.
Does this matter?
Lower severity and a low EPSS score (0.43%). Track it; it rarely justifies an emergency change on its own.
Description
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled.
- CVSS 3.1
- 5.7 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 0.43% probability · 36th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- splunk/splunk · splunk/splunk cloud platform
- Source
- prodsec@splunk.com
References
- https://advisory.splunk.com/advisories/SVD-2023-0210Vendor Advisory
- https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/Vendor Advisory
- https://advisory.splunk.com/advisories/SVD-2023-0210Vendor Advisory
- https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.