CVE-2023-22938

Permissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk Enterprise

State: Published
Severity: 4.3 Medium
Published: Feb 14, 2023
Updated: Mar 19, 2025
Reserved: Jan 10, 2023

Description

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance. The endpoint is now restricted to the ‘splunk-system-user’ account on the local instance.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	Splunk

Weaknesses

CWE-285 The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	8.1 to before 8.1.13Affected 8.2 to before 8.2.10Affected 9.0 to before 9.0.4Affected
Splunk Cloud PlatformSplunk	- to before 9.0.2212Affected

References

https://advisory.splunk.com/advisories/SVD-2023-0208

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.