Vulnerability · Published Feb 14, 2023 · Assigned by Splunk
CVE-2023-22931‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk Enterprise
Medium 4.3
In plain English
A medium-severity security flaw in Splunk Cloud Platform from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 69.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions. This feature has been deprecated and disabled by default.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 8.1 – before 8.1.138.2 – before 8.2.10 |
| Splunk | Splunk Cloud Platform | - – before 8.2.2203 |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N