Riskcovery

CVE-2023-22936

Authenticated Blind Server Side Request Forgery via the ‘search_listener’ Search Parameter in Splunk Enterprise

State
Published
Severity
6.3 Medium
Published
Feb 14, 2023
Updated
Feb 28, 2025
Reserved
Jan 10, 2023

Read the record on cve.org

Description

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an authenticated user. The initiator of the request cannot see the response without the presence of an additional vulnerability within the environment.

Scores

CVSSScoreVectorSource
3.16.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LSplunk

Weaknesses

  • CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected Products

ProductVersions
Splunk EnterpriseSplunk
  • 8.1 to before 8.1.13Affected
  • 8.2 to before 8.2.10Affected
  • 9.0 to before 9.0.4Affected
Splunk Cloud PlatformSplunk
  • - to before 9.0.2209.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.