Vulnerabilities > Splunk

DATE CVE VULNERABILITY TITLE RISK
2022-11-04 CVE-2022-43570 XXE vulnerability in Splunk and Splunk Cloud Platform
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injection via a custom View.
network
low complexity
splunk CWE-611
6.5
6.5
2022-11-04 CVE-2022-43572 Code Injection vulnerability in Splunk and Splunk Cloud Platform
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk (S2S) or HTTP Event Collector (HEC) protocols to an indexer results in a blockage or denial-of-service preventing further indexing.
network
low complexity
splunk CWE-94
6.5
6.5
2022-11-03 CVE-2022-43561 Cross-site Scripting vulnerability in Splunk and Splunk Cloud Platform
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts that can lead to persistent cross-site scripting (XSS).
network
low complexity
splunk CWE-79
4.8
4.8
2022-11-03 CVE-2022-43571 Code Injection vulnerability in Splunk and Splunk Cloud Platform
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.
network
low complexity
splunk CWE-94
8.8
8.8
2022-10-29 CVE-2022-42915 Double Free vulnerability in multiple products
curl before 7.86.0 has a double free.
network
high complexity
haxx fedoraproject netapp apple splunk CWE-415
8.1
8.1
2022-10-29 CVE-2022-42916 Cleartext Transmission of Sensitive Information vulnerability in multiple products
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP.
network
low complexity
haxx fedoraproject apple splunk CWE-319
7.5
7.5
2022-09-23 CVE-2022-35252 When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses.
network
high complexity
haxx netapp apple debian splunk
3.7
3.7
2022-08-23 CVE-2021-31566 Link Following vulnerability in multiple products
An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. 		7.8
7.8
2022-08-16 CVE-2022-37437 Improper Certificate Validation vulnerability in Splunk 9.0.0
When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service (S3) in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination.
network
low complexity
splunk CWE-295
critical
 9.8
9.8
2022-08-16 CVE-2022-37438 Unspecified vulnerability in Splunk and Splunk Cloud Platform
In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information (for example, username, email, and real name) about Splunk users, when visited by another user through the drilldown component.
network
low complexity
splunk
3.5
3.5