What’s Vulnerable › Vulnerabilities

CVE-2023-22940: SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise

• Severity: medium (CVSS 5.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-14 · updated 2026-06-17
• Weakness: CWE-20

Description

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled.

Affected products

• Splunk Enterprise: from 8.1.0 before 8.1.13; from 8.2.0 before 8.2.10; from 9.0.0 before 9.0.4 — fixed in 8.1.13, 8.2.10, 9.0.4
• Splunk Cloud Platform: before 9.0.2209.3 — fixed in 9.0.2209.3

How to fix

Upgrade to a fixed version: Splunk Enterprise 8.1.13, 8.2.10, 9.0.4; Splunk Cloud Platform 9.0.2209.3. Check the vendor advisory for mitigations.

References

• https://advisory.splunk.com/advisories/SVD-2023-0210
• https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/
• https://advisory.splunk.com/advisories/SVD-2023-0210
• https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/

Get alerted when CVE-2023-22940 or the next vulnerability affects your stack