CVE-2023-40596

Summary of CVE-2023-40596 (Splunk Enterprise on Windows) A DLL shipped with Splunk Enterprise references an insecure OPENSSLDIR build definition path, enabling an attacker to install malicious code and achieve privilege escalation on Windows. Affected versions are Splunk Enterprise prior to 8.2.1...

CVE-2023-40596 Splunk Enterprise on Windows Privilege Escalation due to Insecure OPENSSLDIR Build Definition Reference in DLL

In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library DLL that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and subsequently install malicious code to achieve privilege...

CVE-2023-40596 Splunk Enterprise on Windows Privilege Escalation due to Insecure OPENSSLDIR Build Definition Reference in DLL

In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library DLL that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and subsequently install malicious code to achieve privilege...

CVE-2023-40593

Summary: CVE-2023-40593 affects Splunk Enterprise versions prior to 9.0.6 and 8.2.12. A malformed SAML request to the /saml/acs endpoint can cause a denial of service via a crash or hang of the Splunk daemon. Details from connected sources: Advised fixes include updating to Splunk Enterprise 9.0....

CVE-2023-40593 Denial of Service (DoS) in Splunk Enterprise Using a Malformed SAML Request

In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language SAML request to the /saml/acs REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon...

CVE-2023-40594 Denial of Service (DoS) via the ‘printf’ Search Function

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service DoS against the Splunk Enterprise instance...

CVE-2023-40594 Denial of Service (DoS) via the ‘printf’ Search Function

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service DoS against the Splunk Enterprise instance...

CVE-2023-40594

The CVE-2023-40594 issue affects Splunk Enterprise. Affected versions are Splunk Enterprise < 8.2.12, < 9.0.6, and

CVE-2023-4571

CVE-2023-4571 affects Splunk IT Service Intelligence (ITSI) prior to 4.13.3, 4.15.3, and 4.17.1. An attacker could inject ANSI escape codes into ITSI log files, which, when read by a terminal application that translates these codes, can cause code execution in the vulnerable application. The expl...

CVE-2023-4571 Unauthenticated Log Injection in Splunk IT Service Intelligence (ITSI)

In Splunk IT Service Intelligence ITSI versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject American National Standards Institute ANSI escape codes into Splunk ITSI log files that, when a vulnerable terminal application reads them, can run malicious code in the vulnerable...

CVE-2023-40592

CVE-2023-40592 affects Splunk Enterprise: versions below 9.1.1, 9.0.6, and 8.2.12 are vulnerable due to a reflected XSS in the /app/search/table endpoint. The underlying issue allows an attacker to craft a special web request that can lead to arbitrary command execution on the Splunk platform. Re...

CVE-2023-40592 Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpoint

In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting XSS on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk...

CVE-2023-40592 Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpoint

In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting XSS on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk...

CVE-2023-40595

CVE-2023-40595 affects Splunk Enterprise prior to 8.2.12, 9.0.6, and 9.1.1. The issue arises from a deserialization flaw in the Splunk Web interface that allows an attacker to send a specially crafted query to serialize untrusted data, enabling arbitrary code execution. Exploitation details in co...

CVE-2023-40595 Remote Code Execution via Serialized Session Payload

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code...

CVE-2023-40598 Command Injection in Splunk Enterprise Using External Lookups

In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code ...

CVE-2023-40598 Command Injection in Splunk Enterprise Using External Lookups

In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code ...

CVE-2023-40598

CVE-2023-40598 affects Splunk Enterprise prior to 8.2.12, 9.0.6, and 9.1.1. The issue allows an attacker to create an external lookup that calls a legacy internal function, enabling insertion of code into the Splunk installation directory and resulting in arbitrary code execution on the platform ...

Splunk 安全漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze data and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

Splunk 注入漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. It is used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. Splunk has an injection vulnerability that stems...