CVE-2023-22938

MEDIUM

Splunk Enterprise < 8.1.13, < 8.2.10, < 9.0.4 - Authenticated Email Spoofing via sendemail REST Endpoint

Title source: llm

Description

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance. The endpoint is now restricted to the ‘splunk-system-user’ account on the local instance.

References (1)

Core 1

Core References

Vendor Advisory

https://advisory.splunk.com/advisories/SVD-2023-0208

Scores

CVSS v3 4.3

EPSS 0.0025

EPSS Percentile 48.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-285

Status published

Products (2)

splunk/splunk 8.1.0 - 8.1.13

splunk/splunk_cloud_platform < 9.0.2209.3

Published Feb 14, 2023

Tracked Since Feb 18, 2026