8.8

CVE-2023-46214

Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing

In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Splunk ≫ Cloud Version < 9.1.2308
Splunk ≫ Splunk SwEdition enterprise Version >= 9.0.0 < 9.0.7
Splunk ≫ Splunk SwEdition enterprise Version >= 9.1.0 < 9.1.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 89.07% 0.998
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
prodsec@splunk.com 8 1.3 6
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE-91 XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

https://advisory.splunk.com/advisories/SVD-2023-1104
Vendor Advisory
https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/
Vendor Advisory
https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/
Vendor Advisory