CVE-2023-46214 Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing

2023-11-1620:15:25

Splunk

github.com

cve-2023-46214

rce

splunk enterprise

insecure xml parsing

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

7.7

Confidence

Low

SSVC

Exploitation

PoC

Automatable

Technical Impact

Total

JSON

In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
    ],
    "vendor": "splunk",
    "product": "splunk_enterprise",
    "versions": [
      {
        "status": "affected",
        "version": "9.1",
        "lessThan": "9.1.2",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "9.0",
        "lessThan": "9.0.7",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]