What is CVE-2023-22931?

CVE-2023-22931 is a medium-severity vulnerability in Splunk, classified under Improper Authorization. CVSS score: 4.3/10. Published 2023-02-14.

How severe is CVE-2023-22931?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Splunk

CVE-2023-22931

In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions. This feature has been deprecated and disabled by default.

EPSS: 0.004 (28.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Affected products

Splunk
Splunk Cloud Platform
Splunk Splunk_cloud_platform
Splunk Enterprise — versions 8.1, 8.2

Weakness classification (CWE)

CWE-285 — Improper Authorization
CWE-276 — Incorrect Default Permissions

References

prodsec@splunk.com (Vendor Advisory)
prodsec@splunk.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-22931?: CVE-2023-22931 is a medium-severity vulnerability in Splunk, classified under Improper Authorization. CVSS score: 4.3/10. Published 2023-02-14.
How severe is CVE-2023-22931?: Medium severity. CVSS v3 base score is 4.3 out of 10.