CVE Vulnerability Catalog

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user without admin or power roles could inject SPL into saved-search dispatch requests. This could allow unauthorized access to data and affect system integrity.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Monitoring Console. Splunk then runs attacker-controlled SPL with the victim's permissions.

An unauthenticated attacker can trick a user with the "admin" role into opening a crafted link to Monitoring Console. When opened, Splunk Enterprise runs attacker-controlled SPL with that user's permissions, potentially exposing data or modifying lookup data. The vulnerability is due to insufficient validation of data used to build dashboard searches in Monitoring Console.

A user with the "power" role can store attacker-controlled SPL in a dashboard. When another authenticated user exports the dashboard as a PDF, Splunk Enterprise runs the injected SPL with that user's permissions, potentially allowing access or modification of data. The vulnerability is due to insufficient validation of dashboard content before processing PDF exports.

An unauthenticated attacker can trick a user with the "admin" or "sc_admin" role into opening a crafted Splunk Web URL. The resulting dashboard searches could run arbitrary SPL commands with the victim's permissions, potentially exposing data and affecting search results or lookup data. The vulnerability is due to improper neutralization of caller-supplied values in Splunk Secure Gateway dashboards.

A user without the "admin" or "power" roles can store a dashboard view that runs JavaScript in another user's browser when they open it and hover over a sparkline table cell, potentially allowing access to all relevant data and system integrity. The vulnerability is due to insufficient restriction of tooltip options and lack of escaping tooltip content before display.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user with power role could store a malicious ui-tour knowledge object and share it at the app level. The object can execute arbitrary JavaScript in another user's browser.

A user with the "power" role can create a malicious Splunk Web tour and cause arbitrary JavaScript to run in another user's browser when they open a crafted tour link. The JavaScript runs in the victim's browser, allowing access to all relevant data. The XSS vulnerability is due to insufficient output encoding of tour content and navigation links and accepting a tour selector value that can be treated as markup.

A user without the "admin" or "power" roles can bypass SPL safeguards for risky commands through the Job Details dashboard. The injected SPL could run with the permissions of an authenticated user who opens a crafted Job Details dashboard link. This could allow access to all relevant data and affect system integrity. The vulnerability is due to improper neutralization of a caller-supplied search identifier before placing it into SPL searches.

A user with the "user" role could craft a Dashboard Studio dashboard that runs attacker-controlled SPL for another authenticated user. The attacker-controlled SPL could access all relevant data and affect system integrity and availability. The vulnerability is due to inconsistent enforcement of the expected app-visibility authorization boundary before dashboard search query options reach search dispatch.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary SPL into requests that search for events near a selected event. This could allow unauthorized search execution.

An unauthenticated attacker could cause an authenticated user to run arbitrary SPL searches on their behalf through the Event Type Builder. This could expose all relevant data and stored credentials. The vulnerability occurs when the Event Type Builder accepts cross-site request input and retains SPL-affecting values while building sample event searches.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user without fsh_manage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow access to data and affect system integrity and availability.

A user with a role that has the schedule_search capability could store a malicious script in an alert trigger condition field. When another user opens the crafted link, the script runs in that user's browser and could access all data available to that user. The vulnerability is due to using the alert threshold value in generated alert trigger condition markup without escaping special characters.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user without admin or power roles could move files readable by the Splunk account into a lookup they control. This could allow access to data and affect system integrity and availability.

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store an SPL pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all relevant data, affect system integrity, and affect availability. The SPL injection is possible because Deployment Server client identifiers are placed into dispatched searches without neutralizing special characters.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user without the "admin" or "power" roles could execute arbitrary code on the Splunk platform instance through Splunk Web Manager Configuration. The user could then access all relevant data and affect system integrity and availability. The vulnerability exists because Splunk Web Manager Configuration evaluates manager configuration values, and the REST API path for manager configuration does not require the permission that normally controls manager configuration writes.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user without the "admin" or "power" roles could perform Remote Code Execution (RCE) by submitting crafted Splunk Web Manager Configuration content. The user could then access all relevant data and affect system integrity and availability. The vulnerability exists because Splunk Web evaluates manager XML expressions without sufficient input restrictions, and the associated configuration route does not require the capability expected for manager configuration changes.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user without the "admin" or "power" roles could perform Remote Code Execution (RCE) by uploading a malicious knowledge bundle and causing it to be used by distributed search, which can allow for access to all relevant data and affect system integrity and availability. The vulnerability exists because the REST API endpoint for knowledge bundle upload does not require the high-privilege capability edit_dist_peer, and distributed search accepts caller-supplied knowledge bundle selections from users who do not hold that capability.

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a page that embeds a Splunk report could use exposed session material to access all relevant data and affect system integrity. The vulnerability is possible because the dispatch archive download path does not correctly enforce the embedded-report authorization boundary and includes sensitive session material in archived search-job data.