In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands using a saved search job. The vulnerability requires an authenticated user to craft the saved job and a higher privileged user to initiate a request within their browser.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Splunk | Splunk | 8.1.0 (including) | 8.1.13 (excluding) |
| Splunk | Splunk | 8.2.0 (including) | 8.2.10 (excluding) |
| Splunk | Splunk | 9.0.0 (including) | 9.0.4 (excluding) |
| Splunk_cloud_platform | Splunk | * | 9.0.2209.3 (excluding) |