cve/2023/CVE-2023-22942.md

### [CVE-2023-22942](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22942)
![](https://img.shields.io/static/v1?label=Product&message=Splunk%20Enterprise&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=8.1%3C%208.1.13%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=The%20web%20application%20does%20not%2C%20or%20can%20not%2C%20sufficiently%20verify%20whether%20a%20well-formed%2C%20valid%2C%20consistent%20request%20was%20intentionally%20provided%20by%20the%20user%20who%20submitted%20the%20request.&color=brighgreen)

### Description

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a potential attacker update SSG KV store collections using an HTTP GET request.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds