A high-severity injection vulnerability in Splunk Enterprise permits unauthorized data manipulation through the generation of malformed database queries.

This is a query injection vulnerability (CWE-943) that occurs when the application constructs data store queries using untrusted input. The attacker does not require authentication (PR:N) but requires user interaction (UI:R) to trigger the malicious query.

Successful exploitation allows an attacker to manipulate or exfiltrate sensitive data stored within the Splunk Enterprise database. This could lead to a breach of internal audit logs or sensitive configuration data, resulting in severe reputational damage and regulatory non-compliance. The CVSS score of 8.8 highlights the high risk to data integrity.

Immediate Action: Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, 9.4.14, or higher.

Proactive Monitoring: Audit database query logs for patterns indicative of injection attempts, such as unexpected syntax or unauthorized access requests.

Compensating Controls: Deploy a Web Application Firewall to filter malicious inputs and neutralize common injection payloads before they reach the application layer.

Public Exploit Available: Unknown

This vulnerability could be leveraged to bypass security controls or access private data stores. Security teams are urged to apply the recommended updates immediately to eliminate the risk of malicious query injection.