Vulnerability Description
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk | >= 8.1.0, < 8.1.13 |
| Splunk | Splunk Cloud Platform | < 9.0.2209.3 |
Related Weaknesses (CWE)
References
- https://advisory.splunk.com/advisories/SVD-2023-0210Vendor Advisory
- https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/Vendor Advisory
- https://advisory.splunk.com/advisories/SVD-2023-0210Vendor Advisory
- https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/Vendor Advisory
FAQ
What is CVE-2023-22940?
CVE-2023-22940 is a vulnerability with a CVSS score of 6.3 (MEDIUM). In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘mevent...
How severe is CVE-2023-22940?
CVE-2023-22940 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-22940?
Check the references section above for vendor advisories and patch information. Affected products include: Splunk Splunk, Splunk Splunk Cloud Platform.