CVE-2023-22940
SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 8.1.13, 8.2.10, 9.0.4, 9.0.2212
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled.
Timeline
- CVE published
- Record last updated
Affected versions
- Splunk Splunk Enterprise
From 8.1 · fixed in 8.1.13; From 8.2 · fixed in 8.2.10; From 9.0 · fixed in 9.0.4
- Splunk Splunk Cloud Platform
fixed in 9.0.2212