CVE-2023-22938

Published Feb 14, 2023

Last updated 7 months ago

Overview

Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance. The endpoint is now restricted to the ‘splunk-system-user’ account on the local instance.
Source: prodsec@splunk.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo
prodsec@splunk.com: CWE-285

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "24C628AD-CF89-4FD5-B58F-38D150D2F535",
            "versionEndExcluding": "8.1.13",
            "versionStartIncluding": "8.1.0"
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4B2A60A4-55C6-4C11-B86D-452CC43D85FF",
            "versionEndExcluding": "8.2.10",
            "versionStartIncluding": "8.2.0"
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "39FFDC8F-FC45-41E7-8353-D09AAE26F50F",
            "versionEndExcluding": "9.0.4",
            "versionStartIncluding": "9.0.0"
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8AF379C7-8910-4C30-882A-4CE9F9C9992C",
            "versionEndExcluding": "9.0.2209.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

Weaknesses

Configurations

References