CVE-2023-46214

Summary

In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.

Impact & exploitability

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected products we track (1)

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

• NVD record
• https://advisory.splunk.com/advisories/SVD-2023-1104Advisory
• https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/Advisory
• https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/Advisory