Vulnerability · Published Jun 15, 2022 · Assigned by Splunk
CVE-2022-32154Risky commands warnings in Splunk Enterprise Dashboards
Medium 6.8
In plain English
A medium-severity improper input validation in Splunk Cloud Platform from Splunk, Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Official description
Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) for more information. Note that the attack is browser-based and an attacker cannot exploit it at will.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk, Inc | Splunk Enterprise | 9.0 – before 9.0 |
| Splunk, Inc | Splunk Cloud Platform | 8.2 – before 8.2.2106 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates x_refsource_CONFIRM
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0604.html x_refsource_CONFIRM
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands x_refsource_CONFIRM
- https://research.splunk.com/application/splunk_command_and_scripting_interpreter_risky_commands/ x_refsource_CONFIRM
- https://research.splunk.com/application/splunk_command_and_scripting_interpreter_risky_spl_mltk/ x_refsource_CONFIRM
- https://research.splunk.com/application/splunk_command_and_scripting_interpreter_delete_usage/ x_refsource_CONFIRM