CVE-2023-22942

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a potential attacker update SSG KV store collections using an HTTP GET request.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Splunk	Splunk Enterprise	>= 8.1, < 8.1.13; >= 8.2, < 8.2.10; >= 9.0, < 9.0.4

References

https://advisory.splunk.com/advisories/SVD-2023-0212Vendor Advisory
https://research.splunk.com/application/4742d5f7-ce00-45ce-9c79-5e98b43b4410/Vendor Advisory
https://advisory.splunk.com/advisories/SVD-2023-0212Vendor Advisory
https://research.splunk.com/application/4742d5f7-ce00-45ce-9c79-5e98b43b4410/Vendor Advisory

Timeline

Published: Feb 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-229435.3In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs throu CVE-2023-229454.3In the GrowthExperiments extension for MediaWiki through 1.39, the growthmanagementorlist API allows blocked users (blocked in ApiManageMent CVE-2023-229469.9In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The appl CVE-2023-229477.3Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local at CVE-2023-229484.9An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is unsecured read access to an SSH private key. Any code that runs CVE-2023-229494.9An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access reque CVE-2023-22957.5A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only un CVE-2023-229506.5An issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsql_server, created by any user with designer permi CVE-2023-229518.8An issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal systems use. This token c CVE-2023-229528.8In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input vali CVE-2023-229538.8In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.CVE-2023-229557.8An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksu