High severity · published Nov 16, 2023
CVE-2023-46214
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply
8.8
CVSS
89.2%
EPSS
No
On KEV
Description
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)89.2% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Cloud · Splunk
before 9.1.2308 · source: NVD
SP
Splunk · Splunk
9.0.0 before 9.0.7; 9.1.0 before 9.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46214
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46214
Vendor Advisory
https://advisory.splunk.com/advisories/SVD-2023-1104
Vendor Advisory
https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/
Vendor Advisory
https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/
More from Cloud
7.5
CVE-2024-36982
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer…
6.5
CVE-2024-36987
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the…
6.5
CVE-2024-23675
In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming…
5.7
CVE-2024-36986
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands…
5.3
CVE-2024-23677
In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file