PT-2023-4797 · Splunk · Splunk Enterprise

Danylo Dmytriiev + 1 · Published 2023-08-16 · Updated 2024-04-10 · CVE-2023-40595

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 8.2.12 Splunk Enterprise versions prior to 9.0.6 Splunk Enterprise versions prior to 9.1.1

Description The issue is related to a deserialization mechanism flaw in the Splunk Web interface of Splunk Enterprise, allowing an attacker to execute arbitrary code by sending a specially crafted query. This can be used to serialize untrusted data, leading to code execution. Approximately 12,000 vulnerable public instances have been found.

Recommendations For versions prior to 8.2.12, update to version 8.2.12 or later. For versions prior to 9.0.6, update to version 9.0.6 or later. For versions prior to 9.1.1, update to version 9.1.1 or later.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-05248

CVE-2023-40595

Affected Products

Splunk Enterprise

References · 10

• https://advisory.splunk.com/advisories/SVD-2023-0804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40595 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40595 · Vendor Advisory
• https://research.splunk.com/application/d1d8fda6-874a-400f-82cf-dcbb59d8e4db · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05248 · Security Note
• https://vuldb.com/ru/?id.238342 · Note
• https://t.me/cibsecurity/69472 · Telegram Post
• https://t.me/true_secator/4795 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023090417 · Note
• https://twitter.com/leak_ix/status/1699092489574006923 · Twitter Post