CVE-2023-32706: Detailed Vulnerability Analysis and Overview

CVE-2023-32706 Vulnerability Summary

On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an unauthenticated attacker can send specially-crafted messages to the XML parser within SAML authentication to cause a denial of service in the Splunk daemon.

CVE-2023-32706: Detailed Information and External References

EPSS

0.00055

EPSS %

0.24014

References

0.00055

• https://advisory.splunk.com/advisories/SVD-2023-0601

CWE

CWE-611

CAPEC

0.00055

• Data Serialization External Entities Blowup: This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.

Vulnerable Configurations

• cpe:2.3:a:splunk:splunk:8.1.0:*:*:*:enterprise:*:*:*
  cpe:2.3:a:splunk:splunk:8.1.0:*:*:*:enterprise:*:*:*
• cpe:2.3:a:splunk:splunk:8.1.1:*:*:*:enterprise:*:*:*
  cpe:2.3:a:splunk:splunk:8.1.1:*:*:*:enterprise:*:*:*
• cpe:2.3:a:splunk:splunk:8.1.2:*:*:*:enterprise:*:*:*
  cpe:2.3:a:splunk:splunk:8.1.2:*:*:*:enterprise:*:*:*
• cpe:2.3:a:splunk:splunk:8.1.4:*:*:*:enterprise:*:*:*
  cpe:2.3:a:splunk:splunk:8.1.4:*:*:*:enterprise:*:*:*
• cpe:2.3:a:splunk:splunk:8.1.5:*:*:*:enterprise:*:*:*
  cpe:2.3:a:splunk:splunk:8.1.5:*:*:*:enterprise:*:*:*
• cpe:2.3:a:splunk:splunk:8.1.6:*:*:*:enterprise:*:*:*
  cpe:2.3:a:splunk:splunk:8.1.6:*:*:*:enterprise:*:*:*
• cpe:2.3:a:splunk:splunk:8.1.7:*:*:*:enterprise:*:*:*
  cpe:2.3:a:splunk:splunk:8.1.7:*:*:*:enterprise:*:*:*
• cpe:2.3:a:splunk:splunk:8.1.12:*:*:*:enterprise:*:*:*
  cpe:2.3:a:splunk:splunk:8.1.12:*:*:*:enterprise:*:*:*
• cpe:2.3:a:splunk:splunk:8.1.13:*:*:*:enterprise:*:*:*
  cpe:2.3:a:splunk:splunk:8.1.13:*:*:*:enterprise:*:*:*
• cpe:2.3:a:splunk:splunk:8.2.0:*:*:*:enterprise:*:*:*
  cpe:2.3:a:splunk:splunk:8.2.0:*:*:*:enterprise:*:*:*
• cpe:2.3:a:splunk:splunk:8.2.9:*:*:*:enterprise:*:*:*
  cpe:2.3:a:splunk:splunk:8.2.9:*:*:*:enterprise:*:*:*
• cpe:2.3:a:splunk:splunk:8.2.10:*:*:*:enterprise:*:*:*
  cpe:2.3:a:splunk:splunk:8.2.10:*:*:*:enterprise:*:*:*
• cpe:2.3:a:splunk:splunk:9.0.0:*:*:*:enterprise:*:*:*
  cpe:2.3:a:splunk:splunk:9.0.0:*:*:*:enterprise:*:*:*
• cpe:2.3:a:splunk:splunk:9.0.3:*:*:*:enterprise:*:*:*
  cpe:2.3:a:splunk:splunk:9.0.3:*:*:*:enterprise:*:*:*
• cpe:2.3:a:splunk:splunk:9.0.4:*:*:*:enterprise:*:*:*
  cpe:2.3:a:splunk:splunk:9.0.4:*:*:*:enterprise:*:*:*
• cpe:2.3:a:splunk:splunk_cloud_platform:-:*:*:*:*:*:*:*
  cpe:2.3:a:splunk:splunk_cloud_platform:-:*:*:*:*:*:*:*
• cpe:2.3:a:splunk:splunk_cloud_platform:8.1.2103:*:*:*:*:*:*:*
  cpe:2.3:a:splunk:splunk_cloud_platform:8.1.2103:*:*:*:*:*:*:*
• cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2105:*:*:*:*:*:*:*
  cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2105:*:*:*:*:*:*:*
• cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2106:*:*:*:*:*:*:*
  cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2106:*:*:*:*:*:*:*
• cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2107:*:*:*:*:*:*:*
  cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2107:*:*:*:*:*:*:*
• cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2109:*:*:*:*:*:*:*
  cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2109:*:*:*:*:*:*:*
• cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2111:*:*:*:*:*:*:*
  cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2111:*:*:*:*:*:*:*
• cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2112:*:*:*:*:*:*:*
  cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2112:*:*:*:*:*:*:*
• cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2201:*:*:*:*:*:*:*
  cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2201:*:*:*:*:*:*:*
• cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2202:*:*:*:*:*:*:*
  cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2202:*:*:*:*:*:*:*
• cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2203:*:*:*:*:*:*:*
  cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2203:*:*:*:*:*:*:*
• cpe:2.3:a:splunk:splunk_cloud_platform:9.0.2209:*:*:*:*:*:*:*
  cpe:2.3:a:splunk:splunk_cloud_platform:9.0.2209:*:*:*:*:*:*:*
• cpe:2.3:a:splunk:splunk_cloud_platform:9.0.2209.3:*:*:*:*:*:*:*
  cpe:2.3:a:splunk:splunk_cloud_platform:9.0.2209.3:*:*:*:*:*:*:*

CVSS3 Source

nvd@nist.gov

CVSS3 Type

Primary

CVSS3 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H