Vulnerabilities > Splunk > Splunk > 9.0.3

DATE CVE VULNERABILITY TITLE RISK
2024-03-27 CVE-2024-29945 Information Exposure Through Log Files vulnerability in Splunk
In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the software potentially exposes authentication tokens during the token validation process.
network
low complexity
splunk CWE-532
7.2
7.2
2024-03-27 CVE-2024-29946 Command Injection vulnerability in Splunk
In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands.
network
low complexity
splunk CWE-77
8.1
8.1
2024-01-22 CVE-2024-23675 Incorrect Authorization vulnerability in Splunk Cloud and Splunk
In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API).
network
low complexity
splunk CWE-863
6.5
6.5
2024-01-22 CVE-2024-23676 Unspecified vulnerability in Splunk Cloud and Splunk
In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view.
network
low complexity
splunk
3.5
3.5
2024-01-22 CVE-2024-23677 Information Exposure Through Log Files vulnerability in Splunk Cloud and Splunk
In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file.
network
low complexity
splunk CWE-532
5.3
5.3
2024-01-22 CVE-2024-23678 Unspecified vulnerability in Splunk
In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data.
local
low complexity
splunk
8.8
8.8
2023-11-16 CVE-2023-46213 Cross-site Scripting vulnerability in Splunk Cloud and Splunk
In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web browser.
network
low complexity
splunk CWE-79
4.8
4.8
2023-11-16 CVE-2023-46214 XML Injection (aka Blind XPath Injection) vulnerability in Splunk Cloud and Splunk
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply.
network
low complexity
splunk CWE-91
8.8
8.8
2023-08-30 CVE-2023-40592 Cross-site Scripting vulnerability in Splunk and Splunk Cloud Platform
In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XSS) on the “/app/search/table” web endpoint.
network
low complexity
splunk CWE-79
6.1
6.1
2023-08-30 CVE-2023-40593 Unspecified vulnerability in Splunk and Splunk Cloud Platform
In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.
network
low complexity
splunk
7.5
7.5