PT-2023-18786 · Splunk · Splunk Enterprise

Anton + 1 · Published 2023-02-14 · Updated 2024-04-10 · CVE-2023-22942

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 8.1.13 Splunk Enterprise versions prior to 8.2.10 Splunk Enterprise versions prior to 9.0.4

Description A cross-site request forgery in the Splunk Secure Gateway (SSG) app in the 'kvstore client' REST endpoint allows a potential attacker to update SSG KV store collections using an HTTP GET request. The vulnerability affects instances with SSG and Splunk Web enabled.

Recommendations For versions prior to 8.1.13, update to version 8.1.13 or later. For versions prior to 8.2.10, update to version 8.2.10 or later. For versions prior to 9.0.4, update to version 9.0.4 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-22942

Affected Products

Splunk Enterprise

References · 7

• https://osv.dev/vulnerability/CVE-2023-22942 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22942 · Security Note
• https://advisory.splunk.com/advisories/SVD-2023-0212 · Vendor Advisory
• https://research.splunk.com/application/4742d5f7-ce00-45ce-9c79-5e98b43b4410 · Vendor Advisory
• https://t.me/cibsecurity/58135 · Telegram Post
• https://t.me/cvenotify/44835 · Telegram Post
• https://t.me/cvenotify/71758 · Telegram Post