Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Release: Splunk Cloud Platform 9.0.2303.100 Clear all filters
TI-2023-15979 CVE-2023-32707 · GHSA-m653-m4xm-rxrr

‘edit_user’ Capability Privilege Escalation

Priority HIGH 80

In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escala…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.78658 Published 2023-06-01 Fixed in 8.1.14, 8.2.11 +2 CWE-285
TI-2023-15988 CVE-2023-32716 · GHSA-h8v3-qm46-h5jf

Denial of Service via the 'dump' SPL command

Priority LOW 30

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, an attacker can exploit a vulnerability in the {{dump}} SPL command to cause a denial of service by cr…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00624 Published 2023-06-01 Fixed in 8.1.14, 8.2.11 +2 CWE-754
TI-2023-15982 CVE-2023-32710 · GHSA-wm27-q845-m8xc

Information Disclosure via the ‘copyresults’ SPL Command

Priority LOW 24

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can perform an unauthorized transfer of data from a search using the ‘copyres…

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00436 Published 2023-06-01 Fixed in 8.1.14, 8.2.11 +2 CWE-200
TI-2023-15989 CVE-2023-32717 · GHSA-vfcp-ccwj-q6wq

Role-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search Results

Priority LOW 20

On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the {{/services/indexing/preview}} REST endpoint to overwrite searc…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00362 Published 2023-06-01 Fixed in 8.1.14, 8.2.11 +2 CWE-285
TI-2023-15978 CVE-2023-32706 · GHSA-q2jq-j2q9-j85c

Denial Of Service due to Untrusted XML Tag in XML Parser within SAML Authentication

Priority LOW 35

On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an unauthenticated attacker can send specially-crafted messages to the XML parser within SAML authentication to cause a denial of service in the Splunk daemo…

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00602 Published 2023-06-01 Fixed in 8.1.14, 8.2.11 +2 CWE-611
TI-2023-15980 CVE-2023-32708 · GHSA-8v6j-9rv8-9mrh

HTTP Response Splitting via the ‘rest’ SPL Command

Priority LOW 39

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the ‘rest’ SPL command…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00749 Published 2023-06-01 Fixed in 8.1.14, 8.2.11 +2 CWE-113