CVE-2023-22931

‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk Enterprise

State: Published
Severity: 4.3 Medium
Published: Feb 14, 2023
Updated: Feb 28, 2025
Reserved: Jan 10, 2023

Description

In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions. This feature has been deprecated and disabled by default.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	Splunk

Weaknesses

CWE-285 The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	8.1 to before 8.1.13Affected 8.2 to before 8.2.10Affected
Splunk Cloud PlatformSplunk	- to before 8.2.2203Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.