{"api_version":"1","generated_at":"2026-07-23T14:04:14+00:00","cve":"CVE-2023-22940","urls":{"html":"https://cve.report/CVE-2023-22940","api":"https://cve.report/api/cve/CVE-2023-22940.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-22940","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-22940"},"summary":{"title":"CVE-2023-22940","description":"In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled.","state":"PUBLIC","assigner":"prodsec@splunk.com","published_at":"2023-02-14 18:15:00","updated_at":"2023-12-21 01:28:00"},"problem_types":["NVD-CWE-noinfo"],"metrics":[],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2023-0210","name":"https://advisory.splunk.com/advisories/SVD-2023-0210","refsource":"MISC","tags":[],"title":"SVD-2023-0210 | Splunk Vulnerability Disclosure","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://research.splunk.com/endpoint/ee69374a-d27e-4136-adac-956a96ff60fd","name":"https://research.splunk.com/endpoint/ee69374a-d27e-4136-adac-956a96ff60fd","refsource":"MISC","tags":[],"title":"Page Not Found - Splunk Security Content","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/","name":"https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/","refsource":"MISC","tags":[],"title":"","mime":"","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-22940","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22940","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"22940","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"splunk","cpe5":"splunk","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"22940","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"splunk","cpe5":"splunk_cloud_platform","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2023-22940","qid":"378009","title":"Splunk Enterprise Multiple Vulnerabilities (SVD-2023-0212,SVD-2023-0210,SVD-2023-0209,SVD-2023-0205,SVD-2023-0204,SVD-2023-0203)"}]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2023-22940","ASSIGNER":"prodsec@splunk.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled. "}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.","cweId":"CWE-20"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Splunk","product":{"product_data":[{"product_name":"Splunk Enterprise","version":{"version_data":[{"version_affected":"<","version_name":"8.1","version_value":"8.1.13"},{"version_affected":"<","version_name":"8.2","version_value":"8.2.10"},{"version_affected":"<","version_name":"9.0","version_value":"9.0.4"}]}},{"product_name":"Splunk Cloud Platform","version":{"version_data":[{"version_affected":"<","version_name":"-","version_value":"9.0.2212"}]}}]}}]}},"references":{"reference_data":[{"url":"https://advisory.splunk.com/advisories/SVD-2023-0210","refsource":"MISC","name":"https://advisory.splunk.com/advisories/SVD-2023-0210"},{"url":"https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/","refsource":"MISC","name":"https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/"}]},"source":{"advisory":"SVD-2023-0210"},"credits":[{"lang":"en","value":"James Ervin, Splunk"}],"impact":{"cvss":[{"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","version":"3.1","baseScore":6.3,"baseSeverity":"MEDIUM"}]}},"nvd":{"publishedDate":"2023-02-14 18:15:00","lastModifiedDate":"2023-12-21 01:28:00","problem_types":["NVD-CWE-noinfo"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.1,"impactScore":3.6}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"8.2.0","versionEndExcluding":"8.2.10","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"8.1.0","versionEndExcluding":"8.1.13","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.2209.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.4","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}