CVE-2023-32708

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the ‘rest’ SPL command that lets them potentially access other REST endpoints in the system arbitrarily.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2023-0603	Vendor Advisory
https://research.splunk.com/application/e615a0e1-a1b2-4196-9865-8aa646e1708c/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::

History

07 Jun 2023, 14:28

Type	Values Removed	Values Added
References	~~(MISC) https://advisory.splunk.com/advisories/SVD-2023-0603 -~~	(MISC) https://advisory.splunk.com/advisories/SVD-2023-0603 - Vendor Advisory
References	~~(MISC) https://research.splunk.com/application/e615a0e1-a1b2-4196-9865-8aa646e1708c/ -~~	(MISC) https://research.splunk.com/application/e615a0e1-a1b2-4196-9865-8aa646e1708c/ - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
CWE		CWE-436
CPE		cpe:2.3:a:splunk:splunk:::::enterprise:::* cpe:2.3:a:splunk:splunk_cloud_platform::::::::
First Time		Splunk Splunk splunk Cloud Platform Splunk splunk

01 Jun 2023, 17:29

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-06-01 17:15

Updated : 2024-04-10 01:15

NVD link : CVE-2023-32708

Mitre link : CVE-2023-32708

CVE.ORG link : CVE-2023-32708

JSON object : View

Products Affected

splunk

splunk_cloud_platform
splunk

CWE

CWE-436

Interpretation Conflict

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

{"id": "CVE-2023-32708", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "prodsec@splunk.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2023-06-01T17:15:10.173", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2023-0603", "tags": ["Vendor Advisory"], "source": "prodsec@splunk.com"}, {"url": "https://research.splunk.com/application/e615a0e1-a1b2-4196-9865-8aa646e1708c/", "tags": ["Vendor Advisory"], "source": "prodsec@splunk.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-436"}]}, {"type": "Secondary", "source": "prodsec@splunk.com", "description": [{"lang": "en", "value": "CWE-113"}]}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the \u2018rest\u2019 SPL command that lets them potentially access other REST endpoints in the system arbitrarily."}], "lastModified": "2024-04-10T01:15:13.423", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "285DAAE6-0931-41DA-A64A-25ED6A3BE2C5", "versionEndExcluding": "8.1.14", "versionStartIncluding": "8.1.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "E924894C-6C74-4F3B-B8FC-B3FDA0F487F3", "versionEndExcluding": "8.2.11", "versionStartIncluding": "8.2.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "4FF90BE2-6E2E-41F7-A77E-7547CBDD8596", "versionEndExcluding": "9.0.5", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97F2BD15-F25B-488B-B2AC-AD33239B4A27", "versionEndExcluding": "9.0.2303.100"}], "operator": "OR"}]}], "sourceIdentifier": "prodsec@splunk.com"}