Splunk Cloud

In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file.

Published: 2024-01-22T20:37:41.993Z
Updated: 2025-02-28T11:03:55.344Z

In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.

Published: 2024-01-22T20:37:42.546Z
Updated: 2025-06-17T14:24:05.909Z

In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.

Published: 2024-01-22T20:37:23.117Z
Updated: 2025-02-28T11:03:59.164Z

In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.

Published: 2023-11-16T20:15:25.838Z
Updated: 2025-12-16T18:23:23.962Z

In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web browser.

Published: 2023-11-16T20:15:46.739Z
Updated: 2025-02-28T11:03:42.823Z

In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance.

Published: 2023-08-30T16:19:28.135Z
Updated: 2025-02-28T11:03:41.623Z

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.

Published: 2023-08-30T16:19:44.220Z
Updated: 2025-07-01T13:45:24.210Z

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code.

Published: 2023-08-30T16:19:29.761Z
Updated: 2025-02-28T11:03:49.175Z

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance.

Published: 2023-08-30T16:19:40.677Z
Updated: 2025-02-28T11:03:47.517Z

In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.

Published: 2023-08-30T16:19:41.308Z
Updated: 2025-02-28T11:03:56.605Z

In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XSS) on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk platform instance.

Published: 2023-08-30T16:19:38.525Z
Updated: 2025-02-28T11:03:48.911Z