In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects instances with Splunk Web enabled.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Splunk | Splunk | 8.1.0 (including) | 8.1.13 (excluding) |
| Splunk | Splunk | 8.2.0 (including) | 8.2.10 (excluding) |
| Splunk | Splunk | 9.0.0 (including) | 9.0.4 (excluding) |
| Splunk_cloud_platform | Splunk | * | 9.0.2209.3 (excluding) |