Splunk

CVEs (209)

• CVE-2024-36983HigJul 1, 2024
  Splunk

  Splunk
  risk 0.52cvss 8.0epss 0.01

  In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user could create an external lookup that calls a legacy internal function. The authenticated user could use this internal…

• CVE-2023-22933HigFeb 14, 2023
  Splunk

  Splunk
  risk 0.52cvss 8.0epss 0.01

  In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting (XSS) in an extensible mark-up language (XML) View through the ‘layoutPanel’ attribute in the ‘module’ tag’.

• CVE-2022-43569HigNov 4, 2022
  Splunk

  Splunk
  risk 0.52cvss 8.0epss 0.01

  In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can inject and store arbitrary scripts that can lead to persistent cross-site scripting (XSS) in the object name of a Data Model.

• CVE-2023-40597HigAug 30, 2023
  Splunk

  Splunk
  risk 0.51cvss 7.8epss 0.00

  In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.

• CVE-2013-6773HigJan 23, 2020
  Splunk

  Splunk
  risk 0.51cvss 7.8epss 0.00

  Splunk 5.0.3 has an Unquoted Service Path in Windows for Universal Forwarder which can allow an attacker to escalate privileges

• CVE-2024-36991HigJul 1, 2024
  Splunk

  Splunk
  risk 0.50cvss 7.5epss 0.13

  In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

• CVE-2023-32706HigJun 1, 2023
  Splunk

  Splunk
  risk 0.50cvss 7.7epss 0.01

  On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an unauthenticated attacker can send specially-crafted messages to the XML parser within SAML authentication to cause a denial of service in the Splunk daemon.

• CVE-2026-20252HigJun 10, 2026
  Splunk

  Splunk
  risk 0.49cvss 7.6epss 0.00

  In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could send…

• CVE-2026-20239HigMay 20, 2026
  Splunk

  Splunk
  risk 0.49cvss 7.5epss 0.00

  In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the `_internal` index could view session cookies and response bodies that contain…

• CVE-2025-20371HigOct 1, 2025
  Splunk

  Splunk
  risk 0.49cvss 7.5epss 0.00

  In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform…

• CVE-2024-36982HigJul 1, 2024
  Splunk

  Splunk
  risk 0.49cvss 7.5epss 0.00

  In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash of the Splunk daemon.

• CVE-2024-23678HigJan 22, 2024
  Splunk

  Splunk
  risk 0.49cvss 7.5epss 0.00

  In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerability only affects Splunk…

• CVE-2022-43572HigNov 4, 2022
  Splunk

  Splunk
  risk 0.49cvss 7.5epss 0.01

  In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk (S2S) or HTTP Event Collector (HEC) protocols to an indexer results in a blockage or denial-of-service preventing further indexing.

• CVE-2022-32157HigJun 15, 2022
  Splunk

  Splunk
  risk 0.49cvss 7.5epss 0.01

  Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients…

• CVE-2022-32155HigJun 15, 2022
  Splunk

  Splunk
  risk 0.49cvss 7.5epss 0.02

  In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your…

• CVE-2021-31559HigMay 6, 2022
  Splunk

  Splunk
  risk 0.49cvss 7.5epss 0.01

  A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impact Universal…

• CVE-2021-3422HigMar 25, 2022
  Splunk

  Splunk
  risk 0.49cvss 7.5epss 0.01

  The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before…

• CVE-2018-7432HigOct 23, 2018
  Splunk

  Splunk
  risk 0.49cvss 7.5epss 0.02

  Splunk Enterprise 6.2.x before 6.2.14, 6.3.x before 6.3.10, 6.4.x before 6.4.7, and 6.5.x before 6.5.3; and Splunk Light before 6.6.0 allow remote attackers to cause a denial of service via a crafted HTTP request.

• CVE-2018-7429HigOct 23, 2018
  Splunk

  Splunk
  risk 0.49cvss 7.5epss 0.02

  Splunkd in Splunk Enterprise 6.2.x before 6.2.14 6.3.x before 6.3.11, and 6.4.x before 6.4.8; and Splunk Light before 6.5.0 allow remote attackers to cause a denial of service via a malformed HTTP request.

• CVE-2023-22934HigFeb 14, 2023
  Splunk

  Splunk
  risk 0.48cvss 7.3epss 0.01

  In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands using a saved search job. The vulnerability requires an authenticated user to craft the saved job and a…