Risky commands warnings in Splunk Enterprise Dashboards
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.
Summary
Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) for more information. Note that the attack is browser-based and an attacker cannot exploit it at will.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Splunk | Splunk Enterprise | 9.0 to before 9.0 | 9.0 | Patch available | CNA |
| Splunk | Splunk Cloud Platform | 8.2 to before 8.2.2106 | 8.2.2106 | Patch available | CNA |
Remediation
- Fix · CNA Splunk Enterprise (Splunk, Inc) Fixed in 9.0
- Fix · CNA Splunk Cloud Platform (Splunk, Inc) Fixed in 8.2.2106
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Splunk Enterprise 9.0
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2022-13883 Splunk Enterprise disabled TLS validation using the CA certificate stores in Python 3 libraries by defaultPriority MEDIUM 41
- TI-2022-13885 Splunk Enterprise lacked TLS host name validationPriority LOW 37
- TI-2022-13889 Splunk Enterprise deployment servers allow unauthenticated forwarder bundle downloadsPriority LOW 36
Timeline
- 2026-10-02 Threatist record created from CVE-2022-32154
- 2026-10-03 Alias added: GHSA-p25g-64wc-h88x
References
Advisory 6
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0604.html
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands
- https://research.splunk.com/application/splunk_command_and_scripting_interpreter_risky_commands/
- https://research.splunk.com/application/splunk_command_and_scripting_interpreter_risky_spl_mltk/
- https://research.splunk.com/application/splunk_command_and_scripting_interpreter_delete_usage/
More Splunk vulnerabilities
- TI-2026-16444 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise KEVCVSS 3.1CRITICAL 9.8
- TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
- TI-2023-24841 Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing CVSS 3.1HIGH 8.8
- TI-2023-15979 ‘edit_user’ Capability Privilege Escalation CVSS 3.1HIGH 8.8
- TI-2024-30707 Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows CVSS 3.1HIGH 8.8
- TI-2022-21345 Reflected Cross-Site Scripting via the radio template in Splunk Enterprise CVSS 3.1HIGH 8.8
Sources
- CVE-2022-32154 · CVE Program
- CVE-2022-32154 · NVD
- FIRST EPSS
- GHSA-p25g-64wc-h88x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences