← Database

CVE-2023-22936

MEDIUM CVSS: 6.3 Published: 2023-02-14 Modified: 2026-06-17

Description

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an authenticated user. The initiator of the request cannot see the response without the presence of an additional vulnerability within the environment.

Affected Platforms

Splunk Splunk Cloud PlatformSplunk Splunk

Weakness Type

CWE-918, CWE-918

References