Lucene search

[email protected]NVD:CVE-2023-32717

HistoryJun 01, 2023 - 5:15 p.m.

CVE-2023-32717

2023-06-0117:15:10

CWE-285

[email protected]

web.nvd.nist.gov

splunk

security

vulnerability

unauthorized access

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

29.6%

JSON

On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the {{/services/indexing/preview}} REST endpoint to overwrite search results if they know the search ID (SID) of an existing search job.

Affected configurations

NVD

Node

splunksplunkRange8.1.0–8.1.14enterprise

splunksplunkRange8.2.0–8.2.11enterprise

splunksplunkRange9.0.0–9.0.5enterprise

splunksplunk_cloud_platformRange<9.0.2303.100

References

advisory.splunk.com/advisories/SVD-2023-0612

research.splunk.com/application/bbe26f95-1655-471d-8abd-3d32fafa86f8/

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

29.6%

JSON

Related for NVD:CVE-2023-32717

prion1 nessus1 cve1 cvelist1