Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing (Splunk Splunk Enterprise)
En bref
- Source
- NVD
- EPSS
- EPSS 89.17 % · centile 100 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Splunk
- Statut NVD
- Modified
Description
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.
Faiblesses (CWE)
- CWE-91 — Injection XML
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H | Splunk |
| CVSS 3.1 | HIGH 8.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H | NVD · prodsec@splunk.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2023-50457
- GCVE · GCVE-0-2023-46214
Avis du CERT-FR
- CERTFR-2023-AVI-0956 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:splunk:cloud:*:*:*:*:*:*:*:*< 9.1.2308cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 9.0.0 < 9.0.7cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 9.1.0 < 9.1.2
Produits affectés
| Produit | Versions |
|---|---|
| Splunk · Splunk Enterprise | affected 9.0 < 9.0.7 ; affected 9.1 < 9.1.2 |
| Splunk · Splunk Cloud | affected - < 9.1.2308 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |