CVE-2023-22931

‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk Enterprise

CVSS 4.3 MEDIUMEPSS 0.4%CWE-285

In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions. This feature has been deprecated and disabled by default.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected products

Splunk · Splunk Cloud Platform Splunk · Splunk Enterprise

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://advisory.splunk.com/advisories/SVD-2023-0201 https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/