CVE-2023-46214

🗓️ 16 Nov 2023 20:15:25Reported by SplunkType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 243 Views🌐 WEB

Insecure XSLT handling in Splunk Enterpris

Reporter	Title	Published	Views	Family All 17
0day.today	Splunk XSLT Upload Remote Code Execution Exploit	12 Dec 202300:00	–	zdt
BDU FSTEC	The vulnerability of the Splunk Enterprise platform for operational analysis, related to errors in processing XML requests, allows a perpetrator to execute arbitrary code.	20 Nov 202300:00	–	bdu_fstec
Circl	CVE-2023-46214	19 Nov 202307:37	–	circl
CNNVD	Splunk Security Breach	16 Nov 202300:00	–	cnnvd
Cvelist	CVE-2023-46214 Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing	16 Nov 202320:15	–	cvelist
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Splunk Cloud	18 Nov 202322:20	–	githubexploit
Metasploit	Splunk Authenticated XSLT Upload RCE	12 Dec 202319:52	–	metasploit
NCSC	Vulnerability fixed in Splunk	23 Nov 202300:00	–	ncsc
NVD	CVE-2023-46214	16 Nov 202321:15	–	nvd
OSV	CVE-2023-46214	16 Nov 202321:15	–	osv

NVD

Node

splunk cloudRange<9.1.2308

splunk splunkRange9.0.0–9.0.7enterprise

splunk splunkRange9.1.0–9.1.2enterprise

[
  {
    "product": "Splunk Enterprise",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "9.0",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.0.7"
      },
      {
        "version": "9.1",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.1.2"
      }
    ]
  },
  {
    "product": "Splunk Cloud",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "-",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.1.2308"
      }
    ]
  }
]

Source	Link
advisory	www.advisory.splunk.com/advisories/SVD-2023-1104
research	www.research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/
research	www.research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/

Parameter	Position	Path	Description	CWE
spl-file	request body	en-US/splunkd/__upload/indexing/preview	Endpoint used to upload a malicious XSLT payload for later exploitation	CWE-91
input.path	request body	en-US/splunkd/__upload/indexing/preview	Endpoint used to upload a malicious XSLT payload for later exploitation	CWE-91
xsl	query param	en-US/api/search/jobs/{jsid}/results	Endpoint used to trigger XSLT transformation using the uploaded XSLT via xsl parameter	CWE-91
search	request body	en-US/splunkd/__raw/servicesNS/{USERNAME}/search/search/jobs	Endpoint used to create a job for executing the payload and for obtaining a job id	CWE-91

17 Jun 2026 06:30Current

8.5High risk

Vulners AI Score8.5

CVSS 3.18 - 8.8

EPSS0.89066

SSVC

CWE-91