PT-2023-18780 · Splunk · Splunk Enterprise

Published 2023-02-14 · Updated 2024-04-10 · CVE-2023-22937

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 8.1.13 Splunk Enterprise versions prior to 8.2.10 Splunk Enterprise versions prior to 9.0.4

Description The lookup table upload feature in Splunk Enterprise allowed users to upload lookup tables with unnecessary filename extensions. Now, only specific filename extensions are permitted, including .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gzl.

Recommendations For versions prior to 8.1.13, update to version 8.1.13 or later to resolve the issue. For versions prior to 8.2.10, update to version 8.2.10 or later to resolve the issue. For versions prior to 9.0.4, update to version 9.0.4 or later to resolve the issue.

Fix

Unrestricted File Upload

RCE

Weakness Enumeration

CWE-434

CWE-20

Related Identifiers

CVE-2023-22937

Affected Products

Splunk Enterprise

References · 5

• https://advisory.splunk.com/advisories/SVD-2023-0207 · Vendor Advisory
• https://research.splunk.com/application/b7d1293f-e78f-415e-b5f6-443df3480082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22937 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22937 · Vendor Advisory
• https://t.me/cibsecurity/58125 · Telegram Post