CVE-2023-22938 — Permissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk Enterprise

CVE-2023-22938

Permissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk Enterprise PUBLISHED

Description (CNA)

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance. The endpoint is now restricted to the ‘splunk-system-user’ account on the local instance.

Affected (CNA)

Vendor / product	Versions
Splunk / Splunk Enterprise	affected 8.1 before 8.1.13; affected 8.2 before 8.2.10; affected 9.0 before 9.0.4
Splunk / Splunk Cloud Platform	affected - before 9.0.2212

CWE

CWE-285

References

https://advisory.splunk.com/advisories/SVD-2023-0208

ADP enrichment

CVE

No English description supplied.

https://advisory.splunk.com/advisories/SVD-2023-0208

CISA-ADP

No English description supplied.

No references supplied.