TI-2023-09070 Aliases CVE-2023-22938 GHSA-f44g-3vj9-vwv9

Permissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk Enterprise

LOW 20CWE-285Published 2023-02-14 · Updated 2025-03-19

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance. The endpoint is now restricted to the ‘splunk-system-user’ account on the local instance.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00359 29th percentileScored 2026-11-07

Fix Fixed Splunk Enterprise (Splunk): 8.1.13, 8.2.10, 9.0.4Splunk Cloud Platform (Splunk): 9.0.2212

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Splunk	Splunk Enterprise	8.1 to before 8.1.13; 8.2 to before 8.2.10; 9.0 to before 9.0.4	8.1.13, 8.2.10, 9.0.4	Patch available	CNA
Splunk	Splunk Cloud Platform	- to before 9.0.2212	9.0.2212	Patch available	CNA

Splunk Enterprise VendorSplunk Affected 8.1 to before 8.1.13; 8.2 to before 8.2.10; 9.0 to before 9.0.4 Fixed in 8.1.13, 8.2.10, 9.0.4 Patch available CNA
Splunk Cloud Platform VendorSplunk Affected - to before 9.0.2212 Fixed in 9.0.2212 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:splunk:splunk:::::enterprise:::*	8.1.0 to before 8.1.13; 8.2.0 to before 8.2.10; 9.0.0 to before 9.0.4	Vulnerable	Splunk
cpe:2.3:a:splunk:splunk_cloud_platform::::::::	before 9.0.2209.3	Vulnerable	Splunk

cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:* Versions 8.1.0 to before 8.1.13; 8.2.0 to before 8.2.10; 9.0.0 to before 9.0.4 Vulnerable ·Splunk
cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:* Versions before 9.0.2209.3 Vulnerable ·Splunk

Remediation

Fix · CNA Splunk Enterprise (Splunk) Fixed in 8.1.13, 8.2.10, 9.0.4
Fix · CNA Splunk Cloud Platform (Splunk) Fixed in 9.0.2212

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-02-14
Splunk Enterprise 8.1.13, 8.2.10, 9.0.4
10 records Highest priority Priority MEDIUM 2 MEDIUM, 8 LOW
Other records, highest priority first
- TI-2023-09071 SPL Command Safeguards Bypass via the ‘map’ SPL Command in Splunk EnterprisePriority MEDIUM 41
- TI-2023-09067 SPL Command Safeguards Bypass via the ‘display.page.search.patterns.sensitivity’ Search Parameter in Splunk EnterprisePriority MEDIUM 41
- TI-2023-09066 SPL Command Safeguards Bypass via the ‘pivot’ SPL Command in Splunk EnterprisePriority LOW 39
Show all 10 records →
Release · 2023-02-14
Splunk Cloud Platform 9.0.2212
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2023-09073 Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk DaemonPriority LOW 35
- TI-2023-09072 SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk EnterprisePriority LOW 28
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-22938
2026-10-03 Alias added: GHSA-f44g-3vj9-vwv9

References

Advisory 1

https://advisory.splunk.com/advisories/SVD-2023-0208

TI-2026-16444 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise KEVCVSS 3.1CRITICAL 9.8
TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
TI-2023-24841 Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing CVSS 3.1HIGH 8.8
TI-2023-15979 ‘edit_user’ Capability Privilege Escalation CVSS 3.1HIGH 8.8
TI-2024-30707 Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows CVSS 3.1HIGH 8.8
TI-2022-21345 Reflected Cross-Site Scripting via the radio template in Splunk Enterprise CVSS 3.1HIGH 8.8

See all 297 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences