Design/Logic Flaw

2023-02-1418:15:00

PRIOn knowledge base

www.prio-n.com

splunk

rest api

security flaw

version vulnerability

authorization restrictions

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.2%

JSON

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance. The endpoint is now restricted to the ‘splunk-system-user’ account on the local instance.

CPENameOperatorVersion
splunkge8.2.0
splunklt8.2.10
splunkge8.1.0
splunklt8.1.13
splunkge9.0.0
splunklt9.0.4
splunk_cloud_platformlt9.0.2209.3

Name	Operator	Version
splunk	ge	8.2.0
splunk	lt	8.2.10
splunk	ge	8.1.0
splunk	lt	8.1.13
splunk	ge	9.0.0
splunk	lt	9.0.4
splunk_cloud_platform	lt	9.0.2209.3

References

advisory.splunk.com/advisories/SVD-2023-0208