CyberRota Analysis
AI-GeneratedIn Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14, users lacking "admin" or "power" roles can exploit a flaw in the validation of caller-supplied time values, enabling them to inject Search Processing Language (SPL) into saved-search dispatch requests. This vulnerability poses a significant risk as it allows unauthorized access to sensitive data and compromises system integrity. Organizations using affected versions should prioritize immediate remediation to mitigate potential data breaches and maintain security compliance.
Original NVD Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language (SPL) into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system integrity within Splunk Enterprise. The vulnerability is possible because Splunk Enterprise does not correctly validate caller-supplied time values before using them in saved-search dispatch. For more information see Search endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.2/search-endpoints/search-endpoint-descriptions) in the Splunk documentation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)