CVE-2023-22937

Unnecessary File Extensions Allowed by Lookup Table Uploads in Splunk Enterprise

MEDIUM

4.3

CVSS Score

Published: February 14, 2023 at 05:24 PM UTC

Updated: June 17, 2026 at 05:36 AM UTC

2 products affected across 1 vendorSplunkSplunk Cloud Platform

Using Splunk Enterprise by Splunk?

Get instant alerts when new vulnerabilities affect Splunk Enterprise - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.3

Exploit prediction

EPSS 0.4%

Description

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table upload feature let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now be one of the following only: .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gzl.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Splunk · Splunk

95%

8.1 ≤ v < 8.1.138.1.0 ≤ v < 8.1.138.2 ≤ v < 8.2.108.2.0 ≤ v < 8.2.109.0 ≤ v < 9.0.49.0.0 ≤ v < 9.0.48.1 8.2 9.0

Affected range stops below 8.1.13, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.2.10, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.0.4, so it looks safe — our inference, not a vendor statement

Splunk Cloud Platform · Splunk

95%

v < 9.0.2209.3

Affected range stops below 9.0.2209.3, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

MitigationVendor Advisory

Source: [email protected]

https://advisory.splunk.com/advisories/SVD-2023-0207

Vendor Advisory

Source: [email protected]

https://research.splunk.com/application/b7d1293f-e78f-415e-b5f6-443df3480082/

CVSS

4.3MEDIUMSplunk

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-20CWE-434

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card