Skip to content
OpenAdvisories
High WID-SEC-2023-1346 12 CVEs

Splunk Splunk Enterprise: Mehrere Schwachstellen

Published Jun 1, 2023 · Updated Oct 9, 2023 · Revision 2 · de-DE

Vendor: Splunk Product: Enterprise Product: Splunk Enterprise < 8.1.14 Product: Splunk Enterprise < 8.2.11 Product: Splunk Enterprise < 9.0.5 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um seine Privilegien zu erhöhen, Daten zu manipulieren oder offenzulegen, Sicherheitsvorkehrungen zu umgehen, oder einen Denial of Service zu verursachen.

Product

Splunk Enterprise ermöglicht Monitoring und Analyse von Clickstream-Daten und Kundentransaktionen.

Vulnerabilities 12

  • High 8.8
    CVE-2023-32707 Public exploit EPSS 79%

    ‘edit_user’ Capability Privilege Escalation

    In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admi…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 8.6
    CVE-2023-32712

    Unauthenticated Log Injection in Splunk Enterprise

    In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files that, when a vulnerable terminal application reads them, can potentially, at worst, resu…

    Splunk Splunk Enterprise Universal Forwarder
  • High 8.1
    CVE-2023-32714 EPSS 43%

    Path Traversal in Splunk App for Lookup File Editing

    In the Splunk App for Lookup File Editing versions below 4.0.1, a low-privileged user can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk installation directory.

    Splunk Splunk App for Lookup File Editing
  • High 7.8
    CVE-2023-32713

    Local Privilege Escalation via the ‘streamfwd’ program in Splunk App for Stream

    In Splunk App for Stream versions below 8.1.1, a low-privileged user could use a vulnerability in the streamfwd process within the Splunk App for Stream to escalate their privileges on the machine that runs the Splunk Enterprise instance, up to and including …

    Splunk Splunk App for Stream
  • High 7.7
    CVE-2023-32706

    Denial Of Service due to Untrusted XML Tag in XML Parser within SAML Authentication

    On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an unauthenticated attacker can send specially-crafted messages to the XML parser within SAML authentication to cause a denial of service in the Splunk daemon.

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.2
    CVE-2023-32708

    HTTP Response Splitting via the ‘rest’ SPL Command

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the ‘rest’ SPL command that lets them potentially access othe…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2023-32716

    Denial of Service via the 'dump' SPL command

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, an attacker can exploit a vulnerability in the {{dump}} SPL command to cause a denial of service by crashing the Splunk daemon.

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2023-32711

    Persistent Cross-Site Scripting (XSS) through a URL Validation Bypass within a Dashboard View

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a Splunk dashboard view lets a low-privileged user exploit a vulnerability in the Bootstrap web framework (CVE-2019-8331) and build a stored cross-site scripting (XSS) payload.

    Splunk Splunk Enterprise
  • Medium 4.8
    CVE-2023-32710

    Information Disclosure via the ‘copyresults’ SPL Command

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can perform an unauthorized transfer of data from a search using the ‘copyresults’ command if they know the search I…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.7
    CVE-2023-32715

    Self Cross-Site Scripting (XSS) on Splunk App for Lookup File Editing

    In the Splunk App for Lookup File Editing versions below 4.0.1, a user can insert potentially malicious JavaScript code into the app, which causes that code to run on the user’s machine. The app itself does not contain the potentially malicious JavaScript cod…

    Splunk Splunk App for Lookup File Editing
  • Medium 4.3
    CVE-2023-32709

    Low-privileged User can View Hashed Default Splunk Password

    In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user’ role can see the hashed version of the initial user name and password for the Splunk instance by u…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2023-32717

    Role-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search Results

    On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the {{/services/indexing/preview}} REST endpoint to overwrite search results if they know the search ID (S…

    Splunk Splunk Enterprise Splunk Cloud Platform

Revision history

  1. #2

    PoC für CVE-2023-32707 aufgenommen

  2. #1

    Initiale Fassung

References