cve/2023/CVE-2023-22941.md

### [CVE-2023-22941](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22941)
![](https://img.shields.io/static/v1?label=Product&message=Splunk%20Cloud%20Platform&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Splunk%20Enterprise&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=-%3C%209.0.2212%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=8.1%3C%208.1.13%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=An%20exception%20is%20thrown%20from%20a%20function%2C%20but%20it%20is%20not%20caught.&color=brighgreen)

### Description

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd).

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/eduardosantos1989/CVE-2023-22941
- https://github.com/nomi-sec/PoC-in-GitHub