Lucene search

PRIOn knowledge basePRION:CVE-2023-22931

HistoryFeb 14, 2023 - 6:15 p.m.

Format string

2023-02-1418:15:00

PRIOn knowledge base

www.prio-n.com

splunk

enterprise

security

version

rss

feeds

permissions

deprecated

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.0%

JSON

In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions. This feature has been deprecated and disabled by default.

CPENameOperatorVersion
splunkge8.2.0
splunklt8.2.10
splunkge8.1.0
splunklt8.1.13
splunk_cloud_platformlt8.2.2203

Name	Operator	Version
splunk	ge	8.2.0
splunk	lt	8.2.10
splunk	ge	8.1.0
splunk	lt	8.1.13
splunk_cloud_platform	lt	8.2.2203

References

advisory.splunk.com/advisories/SVD-2023-0201

research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/