PT-2023-4796 · Splunk · Splunk Enterprise

Danylo Dmytriiev

+1

·

Published

2023-08-16

·

Updated

2024-04-10

·

CVE-2023-40598

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 8.2.12 Splunk Enterprise versions prior to 9.0.6 Splunk Enterprise versions prior to 9.1.1
Description The issue is related to the Splunk Web interface of the Splunk Enterprise platform for operational analysis. It is associated with the failure to clean up data at the management level due to the use of the outdated runshellscript command. Exploitation of this issue may allow a remote attacker to execute arbitrary commands. An attacker can create an external lookup that calls a legacy internal function, allowing them to insert code into the Splunk platform installation directory and execute arbitrary code on the Splunk platform instance.
Recommendations For versions prior to 8.2.12, update to version 8.2.12 or later. For versions prior to 9.0.6, update to version 9.0.6 or later. For versions prior to 9.1.1, update to version 9.1.1 or later.

Fix

Missing Authentication

Command Injection

OS Command Injection

Code Injection

Weakness Enumeration

CWE-306CWE-77CWE-78CWE-94

Related Identifiers

BDU:2023-05247
CVE-2023-40598

Affected Products

Splunk Enterprise