CVE-2023-32708
Assigner: Splunk
Published: 2023-06-01T16:34:27.126Z
State: PUBLISHED
affected: product: Splunk Enterprise
vendor: Splunk
versions: version: 8.1
status: affected
versionType: custom
lessThan: 8.1.14
version: 8.2
status: affected
versionType: custom
lessThan: 8.2.11
version: 9.0
status: affected
versionType: custom
lessThan: 9.0.5
product: Splunk Cloud Platform
vendor: Splunk
versions: version: -
status: affected
versionType: custom
lessThan: 9.0.2303.100
descriptions: supportingMedia: base64: no
type: text/html
value: In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the ‘rest’ SPL command that lets them potentially access other REST endpoints in the system arbitrarily.
value: In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the ‘rest’ SPL command that lets them potentially access other REST endpoints in the system arbitrarily.
title: HTTP Response Splitting via the ‘rest’ SPL Command
datePublic: 2023-06-01T00:00:00.000000
metrics: cvssV3_1: vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
baseScore: 7.2
baseSeverity: HIGH
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: type: cvw
description: The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
cweId: CWE-113
source: advisory: SVD-2023-0603
credits: value: Danylo Dmytriiev (DDV_UA)