Lucene search

SplunkCVE-2023-40596

HistoryAug 30, 2023 - 5:15 p.m.

CVE-2023-40596

2023-08-3017:15:10

CWE-665

CWE-427

Splunk

web.nvd.nist.gov

120

splunk

enterprise

cve-2023-40596

dll

insecure path

vulnerability

windows

nvd

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

Percentile

9.0%

JSON

In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and subsequently install malicious code to achieve privilege escalation on the Windows machine.

Affected configurations

Nvd

Node

splunksplunkRange8.2.0–8.2.12enterprise

splunksplunkRange9.0.0–9.0.6enterprise

splunksplunkMatch9.1.0enterprise

AND

microsoftwindowsMatch-

VendorProductVersionCPE
splunksplunk*cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
splunksplunk9.1.0cpe:2.3:a:splunk:splunk:9.1.0:*:*:*:enterprise:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
splunk	splunk	*	cpe:2.3:a:splunk:splunk:::::enterprise:::*
splunk	splunk	9.1.0	cpe:2.3:a:splunk:splunk:9.1.0::::enterprise:::
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

CNA Affected

[
  {
    "product": "Splunk Enterprise",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "8.2",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "8.2.12"
      },
      {
        "version": "9.0",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.0.6"
      },
      {
        "version": "9.1",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.1.1"
      }
    ]
  }
]

References

advisory.splunk.com/advisories/SVD-2023-0805

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2023-40596