Splunk Releases Security Updates for Multiple Products
Thirteen advisories address five High and eight Medium impact vulnerabilities for Splunk Enterprise, Splunk Cloud Platform, Splunk CloudConnect SDK, and Splunk Add-on Builder
Summary
Thirteen advisories address five High and eight Medium impact vulnerabilities for Splunk Enterprise, Splunk Cloud Platform, Splunk CloudConnect SDK, and Splunk Add-on Builder
Affected platforms
The following platforms are known to be affected:
The following platforms are also known to be affected:
- Splunk CloudConnect SDK - 3.1.2 and earlier
Threat details
Introduction
Thirteen advisories address five High and eight Medium impact vulnerabilities in multiple products.
The High vulnerabilities are related to cross-site scripting or allowing searches to bypass search processing language safeguards for risky commands. An attacker could exploit some of these vulnerabilities to take control of a system.
Remediation advice
Affected organisations are encouraged to review the following Splunk Security Advisories for more information.
Remediation steps
| Type | Step |
|---|---|
| Patch |
Modular Input REST API Requests Connect via HTTP after Certificate Validation Failure in Splunk Add-on Builder and Splunk CloudConnect SDK | SVD-2023-0213 https://advisory.splunk.com/advisories/SVD-2023-0213 |
| Patch |
Cross-Site Request Forgery in the ‘ssg/kvstore_client’ REST Endpoint in Splunk Enterprise | SVD-2023-0212 https://advisory.splunk.com/advisories/SVD-2023-0212 |
| Patch |
Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon | SVD-2023-0211 https://advisory.splunk.com/advisories/SVD-2023-0211 |
| Patch |
SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise | SVD-2023-0210 https://advisory.splunk.com/advisories/SVD-2023-0210 |
| Patch |
SPL Command Safeguards Bypass via the ‘map’ SPL Command in Splunk Enterprise | SVD-2023-0209 https://advisory.splunk.com/advisories/SVD-2023-0209 |
| Patch |
Permissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk Enterprise | SVD-2023-0208 https://advisory.splunk.com/advisories/SVD-2023-0208 |
| Patch |
Unnecessary File Extensions Allowed by Lookup Table Uploads in Splunk Enterprise | SVD-2023-0207 https://advisory.splunk.com/advisories/SVD-2023-0207 |
| Patch |
Authenticated Blind Server Side Request Forgery via the ‘search_listener’ Search Parameter in Splunk Enterprise | SVD-2023-0206 https://advisory.splunk.com/advisories/SVD-2023-0206 |
| Patch |
SPL Command Safeguards Bypass via the ‘display.page.search.patterns.sensitivity’ Search Parameter in Splunk Enterprise | SVD-2023-0205 https://advisory.splunk.com/advisories/SVD-2023-0205 |
| Patch |
SPL Command Safeguards Bypass via the ‘pivot’ SPL Command in Splunk Enterprise | SVD-2023-0204 https://advisory.splunk.com/advisories/SVD-2023-0204 |
| Patch |
Persistent Cross-Site Scripting through the ‘module’ Tag in a View in Splunk Enterprise | SVD-2023-0203 https://advisory.splunk.com/advisories/SVD-2023-0203 |
| Patch |
Persistent Cross-Site Scripting through a Base64-encoded Image in a View in Splunk Enterprise | SVD-2023-0202 https://advisory.splunk.com/advisories/SVD-2023-0202 |
| Patch |
‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk Enterprise | SVD-2023-0201 https://advisory.splunk.com/advisories/SVD-2023-0201 |
CVE Vulnerabilities
Last edited: 17 February 2023 3:27 pm