CVE-2023-22939

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects instances with Splunk Web enabled.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Splunk	Splunk Enterprise	>= 8.1, < 8.1.13; >= 8.2, < 8.2.10; >= 9.0, < 9.0.4
Splunk	Splunk Cloud Platform	>= -, < 9.0.2209.3

References

https://advisory.splunk.com/advisories/SVD-2023-0209Vendor Advisory
https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fdVendor Advisory
https://advisory.splunk.com/advisories/SVD-2023-0209Vendor Advisory
https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fdVendor Advisory

Timeline

Published: Feb 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-22946.1A vulnerability was found in UCMS 1.6.0. It has been classified as problematic. This affects an unknown part of the file saddpost.php of the CVE-2023-229405.7In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including CVE-2023-229417.5In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation cra CVE-2023-229424.3In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘k CVE-2023-229435.3In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs throu CVE-2023-229454.3In the GrowthExperiments extension for MediaWiki through 1.39, the growthmanagementorlist API allows blocked users (blocked in ApiManageMent CVE-2023-229469.9In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The appl CVE-2023-229477.3Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local at CVE-2023-229484.9An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is unsecured read access to an SSH private key. Any code that runs CVE-2023-229494.9An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access reque CVE-2023-22957.5A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only un CVE-2023-229506.5An issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsql_server, created by any user with designer permi