CVE-2023-40593

🗓️ 30 Aug 2023 16:19:41Reported by SplunkType

cve🔗 web.nvd.nist.gov👁 137 Views🌐 WEB

Splunk Enterprise <9.0.6, 8.2.12 SAML DoS vulnerability

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2023-40593	30 Aug 202320:12	–	circl
CNNVD	Splunk 安全漏洞	30 Aug 202300:00	–	cnnvd
Cvelist	CVE-2023-40593 Denial of Service (DoS) in Splunk Enterprise Using a Malformed SAML Request	30 Aug 202316:19	–	cvelist
EUVD	EUVD-2023-45151	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Splunk Enterprise	31 Aug 202300:00	–	ncsc
NVD	CVE-2023-40593	30 Aug 202317:15	–	nvd
OSV	CVE-2023-40593	30 Aug 202317:15	–	osv
Prion	Design/Logic Flaw	30 Aug 202317:15	–	prion
Positive Technologies	PT-2023-27527 · Splunk · Splunk Enterprise	30 Aug 202300:00	–	ptsecurity
Tenable Nessus	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6 (SVD-2023-0802)	30 Aug 202300:00	–	nessus

NVD

Node

splunk splunkRange8.2.0–8.2.12enterprise

splunk splunkRange9.0.0–9.0.6enterprise

splunk splunk_cloud_platformRange≤9.0.2305.100

[
  {
    "product": "Splunk Enterprise",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "8.2",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "8.2.12"
      },
      {
        "version": "9.0",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.0.6"
      }
    ]
  },
  {
    "product": "Splunk Cloud",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "-",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.0.2205"
      }
    ]
  }
]

Source	Link
advisory	www.advisory.splunk.com/advisories/SVD-2023-0802
research	www.research.splunk.com/application/8e8a86d5-f323-4567-95be-8e817e2baee6/

Parameter	Position	Path	Description	CWE
SAMLRequest	request body	/saml/acs	Malicious actor can send a malformed SAML request to /saml/acs causing denial of service (crash/hang) of the Splunk daemon in affected versions.	CWE-400

28 Feb 2025 11:03Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.16.3 - 7.5

EPSS0.00157

CWE-400