DeutschShown in its original language — a full translation is planned for a future version.
Splunk Splunk Enterprise: Mehrere Schwachstellen
view advisory published 2023-02-14
Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen, Daten zu manipulieren und einen Cross-Site-Scripting-Angriff durchzuführen.
01
describes (23)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-22943US | medium5.3 | — | ||
In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectl… | ||||
| CVE-2023-22942US | medium4.3 | — | ||
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a pote… | ||||
| CVE-2023-22941US | high7.5 | Exploit | ||
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd). | ||||
| CVE-2023-22940US | medium5.7 | — | ||
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mc… | ||||
| CVE-2023-22939US | high8.8 | — | ||
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands. The vulner… | ||||
| CVE-2023-22938US | medium4.3 | — | ||
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance. The endpoint is n… | ||||
| CVE-2023-22937US | medium4.3 | — | ||
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table upload feature let a user upload lookup tables with unnecessary filename extensions. Lookup table fi… | ||||
| CVE-2023-22936US | medium6.3 | — | ||
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an authenticated… | ||||
| CVE-2023-22935US | high8.8 | — | ||
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘display.page.search.patterns.sensitivity’ search parameter lets a search bypass SPL safeguards for risky command… | ||||
| CVE-2023-22934US | high8.0 | — | ||
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands using a s… | ||||
| CVE-2023-22933US | medium6.1 | — | ||
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting (XSS) in an extensible mark-up language (XML) View through the ‘layoutPanel’ a… | ||||
| CVE-2023-22932US | medium6.1 | — | ||
In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting (XSS) through the error message in a Base64-encoded image. The vulnerability affects instance… | ||||
| CVE-2023-22931US | medium4.3OT elevated | — | ||
In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without veri… | ||||
| CVE-2022-42889US | critical9.8 | Exploit | ||
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where… | ||||
| CVE-2022-32212US | high8.1 | — | ||
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddre… | ||||
| CVE-2022-31129US | high7.5 | — | ||
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Spe… | ||||
| CVE-2015-20107US | high7.6 | Exploit | ||
In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shel… | ||||
| CVE-2022-24785US | high7.5 | Exploit | ||
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between v… | ||||
| CVE-2021-3517US | high8.6 | — | ||
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application li… | ||||
| CVE-2021-3518US | high8.8 | — | ||
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-afte… | ||||
showing 20 of 23
02
references
External citations — patches, advisories, analysis.
- Splunk Security Advisory vom 2023-02-14external
- Splunk Security Advisory vom 2023-02-14external
- Splunk Security Advisory vom 2023-02-14external
- Splunk Security Advisory vom 2023-02-14external
- Splunk Security Advisory vom 2023-02-14external
- Splunk Security Advisory vom 2023-02-14external
- Splunk Security Advisory vom 2023-02-14external
- Splunk Security Advisory vom 2023-02-14external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan