CVE-2023-22937

low-risk

Published 2023-02-14

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table upload feature let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now be one of the following only: .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gzl.

Do I need to act?

0.32% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.3/10 Medium

NETWORK / LOW complexity

Affected Products (2)

Splunk

Splunk Cloud Platform

Affected Vendors

Splunk

References (4)

Mitigation https://advisory.splunk.com/advisories/SVD-2023-0207

Vendor Advisory https://research.splunk.com/application/b7d1293f-e78f-415e-b5f6-443df3480082/

Mitigation https://advisory.splunk.com/advisories/SVD-2023-0207

Vendor Advisory https://research.splunk.com/application/b7d1293f-e78f-415e-b5f6-443df3480082/

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 7/34 · Low