CVE Vulnerability Catalog

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The vulnerability exists because the distributed search authentication token endpoint does not require a signed request to identify a configured search peer, allowing the request to fall back to shared local key material.

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is due to lack of restriction of static file requests to the configured static directory.

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user without admin or power roles could delete all SPL2 modules across the instance via the REST API. This could delete exported datasets and functions, affecting system integrity and causing partial service disruption.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an authenticated user without edit_manager_xml capability could write a malicious Splunk Web Manager XML configuration. When the user opens the page, Splunk runs attacker-controlled OS commands.

A user with the "power" role in Splunk Enterprise can store a Dashboard Studio workflow action containing attacker-controlled SPL. When another authenticated user selects the action, Splunk runs the injected SPL with that user's permissions, potentially allowing access or modification of data. The vulnerability is due to insufficient validation of workflow-action URLs in Dashboard Studio.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user with power role could store a Dashboard Studio workflow action with a crafted URL. When another user selects it, attacker-controlled JavaScript runs in their browser.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. Splunk then runs attacker-controlled SPL with the victim's permissions.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user without admin or power roles could inject SPL into saved-search dispatch requests. This could allow unauthorized access to data and affect system integrity.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Monitoring Console. Splunk then runs attacker-controlled SPL with the victim's permissions.

An unauthenticated attacker can trick a user with the "admin" role into opening a crafted link to Monitoring Console. When opened, Splunk Enterprise runs attacker-controlled SPL with that user's permissions, potentially exposing data or modifying lookup data. The vulnerability is due to insufficient validation of data used to build dashboard searches in Monitoring Console.

A user with the "power" role can store attacker-controlled SPL in a dashboard. When another authenticated user exports the dashboard as a PDF, Splunk Enterprise runs the injected SPL with that user's permissions, potentially allowing access or modification of data. The vulnerability is due to insufficient validation of dashboard content before processing PDF exports.

An unauthenticated attacker can trick a user with the "admin" or "sc_admin" role into opening a crafted Splunk Web URL. The resulting dashboard searches could run arbitrary SPL commands with the victim's permissions, potentially exposing data and affecting search results or lookup data. The vulnerability is due to improper neutralization of caller-supplied values in Splunk Secure Gateway dashboards.

A user without the "admin" or "power" roles can store a dashboard view that runs JavaScript in another user's browser when they open it and hover over a sparkline table cell, potentially allowing access to all relevant data and system integrity. The vulnerability is due to insufficient restriction of tooltip options and lack of escaping tooltip content before display.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user with power role could store a malicious ui-tour knowledge object and share it at the app level. The object can execute arbitrary JavaScript in another user's browser.

A user with the "power" role can create a malicious Splunk Web tour and cause arbitrary JavaScript to run in another user's browser when they open a crafted tour link. The JavaScript runs in the victim's browser, allowing access to all relevant data. The XSS vulnerability is due to insufficient output encoding of tour content and navigation links and accepting a tour selector value that can be treated as markup.

A user without the "admin" or "power" roles can bypass SPL safeguards for risky commands through the Job Details dashboard. The injected SPL could run with the permissions of an authenticated user who opens a crafted Job Details dashboard link. This could allow access to all relevant data and affect system integrity. The vulnerability is due to improper neutralization of a caller-supplied search identifier before placing it into SPL searches.

A user with the "user" role could craft a Dashboard Studio dashboard that runs attacker-controlled SPL for another authenticated user. The attacker-controlled SPL could access all relevant data and affect system integrity and availability. The vulnerability is due to inconsistent enforcement of the expected app-visibility authorization boundary before dashboard search query options reach search dispatch.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary SPL into requests that search for events near a selected event. This could allow unauthorized search execution.

An unauthenticated attacker could cause an authenticated user to run arbitrary SPL searches on their behalf through the Event Type Builder. This could expose all relevant data and stored credentials. The vulnerability occurs when the Event Type Builder accepts cross-site request input and retains SPL-affecting values while building sample event searches.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user without fsh_manage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow access to data and affect system integrity and availability.