Detections
Analytics
Splunk Enterprise 8.1.0 < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0606)
low Nessus Plugin ID 176555
Language:
Synopsis
An application running on a remote web server host is affected by a vulnerabilityDescription
The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0606 advisory.- In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an attacker can use a specially crafted web URL in their browser to cause log file poisoning. The attack requires the attacker to have secure shell (SSH) access to the instance and use a terminal program that supports a certain feature set to execute the attack successfully. (CVE-2023-32712)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
For Splunk Enterprise, upgrade versions to 8.1.14, 8.2.11, 9.0.5, or higher.This vulnerability does not affect Splunk Cloud Platform instances.
See Also
Plugin Details
Severity: Low
ID: 176555
File Name: splunk_905_cve-2023-32712.nasl
Version: 1.4
Type: combined
Agent: windows, macosx, unix
Family: CGI abuses
Published: 6/1/2023
Updated: 8/31/2023
Configuration: Enable paranoid mode
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 2.9
CVSS v2
Risk Factor: Low
Base Score: 2.6
Temporal Score: 1.9
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2023-32712
CVSS v3
Risk Factor: Low
Base Score: 3.1
Temporal Score: 2.7
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:splunk:splunk
Required KB Items: installed_sw/Splunk, Settings/ParanoidReport
Exploit Ease: No known exploits are available
Patch Publication Date: 6/1/2023
Vulnerability Publication Date: 6/1/2023
Reference Information
CVE: CVE-2023-32712
CWE: 117
IAVA: 2023-A-0273-S