CVE-2023-46214
Assigner: Splunk
Published: 2023-11-16T20:15:25.838Z
State: PUBLISHED
affected: product: Splunk Enterprise
vendor: Splunk
versions: version: 9.0
status: affected
versionType: custom
lessThan: 9.0.7
version: 9.1
status: affected
versionType: custom
lessThan: 9.1.2
product: Splunk Cloud
vendor: Splunk
versions: version: -
status: affected
versionType: custom
lessThan: 9.1.2308
descriptions: supportingMedia: base64: no
type: text/html
value: In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.
value: In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.
title: Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing
datePublic: 2023-11-16T00:00:00.000000
metrics: cvssV3_1: vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
baseScore: 8
baseSeverity: HIGH
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: type: cvw
description: The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
cweId: CWE-91
source: advisory: SVD-2023-1104
credits: value: Alex Hordijk