PT-2023-4799 · Splunk · Splunk Enterprise

Will Dormann

·

Published

2023-08-16

·

Updated

2024-04-10

·

CVE-2023-40596

CVSS v3.1

8.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 8.2.12 Splunk Enterprise versions prior to 9.0.6 Splunk Enterprise versions prior to 9.1.1
Description The issue is related to the incorrect initialization of a resource when handling the OPENSSLDIR value in the Splunk Web interface of Splunk Enterprise on Windows. This can be exploited by an attacker to execute arbitrary code and escalate privileges. An attacker can abuse the insecure path reference for the OPENSSLDIR build definition in a dynamic link library (DLL) that ships with Splunk Enterprise, allowing them to install malicious code and achieve privilege escalation on the Windows machine.
Recommendations For versions prior to 8.2.12, update to version 8.2.12 or later. For versions prior to 9.0.6, update to version 9.0.6 or later. For versions prior to 9.1.1, update to version 9.1.1 or later.

Fix

Untrusted Search Path

Improper Initialization

Uncontrolled Search Path Element

Weakness Enumeration

Related Identifiers

BDU:2023-05250
CVE-2023-40596

Affected Products

Splunk Enterprise