High severity · published Nov 16, 2023
CVE-2023-46214
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply
8.8
CVSS
89.2%
EPSS
No
On KEV
Description
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)89.2% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Cloud · Splunk
before 9.1.2308 · source: NVD
SP
Splunk · Splunk
9.0.0 before 9.0.7; 9.1.0 before 9.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46214
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46214
Vendor Advisory
https://advisory.splunk.com/advisories/SVD-2023-1104
Vendor Advisory
https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/
Vendor Advisory
https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/
More from Cloud
8.1
CVE-2024-29946
Risky command safeguards bypass in Dashboard Examples Hub
7.5
CVE-2024-36982
Denial of Service through null pointer reference in “cluster/config” REST endpoint
6.5
CVE-2024-36987
Insecure File Upload in the indexing/preview REST endpoint
6.5
CVE-2024-23675
In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming…
5.7
CVE-2024-36986
Risky command safeguards bypass through Search ID query in Analytics Workspace