CVE-2023-46214 - Vulnerability Details - OpenCVE

In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.87931.

Exploitation poc

Automatable no

Technical Impact total

Vendors	Products
Splunk	Cloud Splunk Splunk Enterprise

Configuration 1 [-]

OR	cpe:2.3:a:splunk:cloud::::::::
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*

No data.

No data.

References

Link	Providers
https://advisory.splunk.com/advisories/SVD-2023-1104
https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/
https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/

History

Wed, 17 Dec 2025 05:15:00 +0000

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'No', 'Exploitation': 'PoC', 'Technical Impact': 'Total'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 15 Oct 2024 20:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Splunk splunk Enterprise
CPEs		cpe:2.3:a:splunk:splunk_enterprise::::::::
Vendors & Products		Splunk splunk Enterprise
Metrics		ssvc `{'options': {'Automatable': 'No', 'Exploitation': 'PoC', 'Technical Impact': 'Total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Splunk

Published: 2023-11-16T20:15:25.838Z

Updated: 2025-12-16T18:23:23.962Z

Reserved: 2023-10-18T17:02:51.236Z

Link: CVE-2023-46214

Vulnrichment

Updated: 2024-08-02T20:37:40.138Z

NVD

Status : Modified

Published: 2023-11-16T21:15:08.630

Modified: 2024-11-21T08:28:05.150

Link: CVE-2023-46214

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-46214", "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469", "state": "PUBLISHED", "assignerShortName": "Splunk", "dateReserved": "2023-10-18T17:02:51.236Z", "datePublished": "2023-11-16T20:15:25.838Z", "dateUpdated": "2025-12-16T18:23:23.962Z"}, "containers": {"cna": {"affected": [{"product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"version": "9.0", "status": "affected", "versionType": "custom", "lessThan": "9.0.7"}, {"version": "9.1", "status": "affected", "versionType": "custom", "lessThan": "9.1.2"}]}, {"product": "Splunk Cloud", "vendor": "Splunk", "versions": [{"version": "-", "status": "affected", "versionType": "custom", "lessThan": "9.1.2308"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance."}], "value": "In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance."}], "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2023-1104"}, {"url": "https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/"}, {"url": "https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/"}], "title": "Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing", "datePublic": "2023-11-16T00:00:00.000Z", "metrics": [{"cvssV3_1": {"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1", "baseScore": 8, "baseSeverity": "HIGH"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "description": "The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.", "cweId": "CWE-91"}]}], "source": {"advisory": "SVD-2023-1104"}, "credits": [{"lang": "en", "value": "Alex Hordijk"}], "providerMetadata": {"orgId": "42b59230-ec95-491e-8425-5a5befa1a469", "shortName": "Splunk", "dateUpdated": "2025-02-28T11:03:52.275Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:37:40.138Z"}, "title": "CVE Program Container", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2023-1104", "tags": ["x_transferred"]}, {"url": "https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/", "tags": ["x_transferred"]}, {"url": "https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-46214", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-10T13:55:55.284479Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"], "vendor": "splunk", "product": "splunk_enterprise", "versions": [{"status": "affected", "version": "9.1", "lessThan": "9.1.2", "versionType": "custom"}, {"status": "affected", "version": "9.0", "lessThan": "9.0.7", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"], "vendor": "splunk", "product": "splunk_enterprise", "versions": [{"status": "affected", "version": "9.1", "lessThan": "9.1.2", "versionType": "custom"}, {"status": "affected", "version": "9.0", "lessThan": "9.0.7", "versionType": "custom"}], "defaultStatus": "unknown"}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T18:23:23.962Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2023-1104", "tags": ["x_transferred"]}, {"url": "https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/", "tags": ["x_transferred"]}, {"url": "https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:37:40.138Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-46214", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-10T13:55:55.284479Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"], "vendor": "splunk", "product": "splunk_enterprise", "versions": [{"status": "affected", "version": "9.1", "lessThan": "9.1.2", "versionType": "custom"}, {"status": "affected", "version": "9.0", "lessThan": "9.0.7", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"], "vendor": "splunk", "product": "splunk_enterprise", "versions": [{"status": "affected", "version": "9.1", "lessThan": "9.1.2", "versionType": "custom"}, {"status": "affected", "version": "9.0", "lessThan": "9.0.7", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-04T20:26:56.068Z"}}], "cna": {"title": "Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing", "source": {"advisory": "SVD-2023-1104"}, "credits": [{"lang": "en", "value": "Alex Hordijk"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Splunk", "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "9.0", "lessThan": "9.0.7", "versionType": "custom"}, {"status": "affected", "version": "9.1", "lessThan": "9.1.2", "versionType": "custom"}]}, {"vendor": "Splunk", "product": "Splunk Cloud", "versions": [{"status": "affected", "version": "-", "lessThan": "9.1.2308", "versionType": "custom"}]}], "datePublic": "2023-11-16T00:00:00.000Z", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2023-1104"}, {"url": "https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/"}, {"url": "https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/"}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.", "supportingMedia": [{"type": "text/html", "value": "In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-91", "description": "The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system."}]}], "providerMetadata": {"orgId": "42b59230-ec95-491e-8425-5a5befa1a469", "shortName": "Splunk", "dateUpdated": "2025-02-28T11:03:52.275Z"}}}, "cveMetadata": {"cveId": "CVE-2023-46214", "state": "PUBLISHED", "dateUpdated": "2025-12-16T18:23:23.962Z", "dateReserved": "2023-10-18T17:02:51.236Z", "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469", "datePublished": "2023-11-16T20:15:25.838Z", "assignerShortName": "Splunk"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:splunk:cloud:*:*:*:*:*:*:*:*", "matchCriteriaId": "9DD1990F-262A-4EE8-B2CB-15D460FE0A09", "versionEndExcluding": "9.1.2308", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "6F8221CD-BD35-4F7E-99D7-DC3D6458CF3B", "versionEndExcluding": "9.0.7", "versionStartIncluding": "9.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "1FBA35E0-60C0-444F-A544-8AA9C80FF94B", "versionEndExcluding": "9.1.2", "versionStartIncluding": "9.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance."}, {"lang": "es", "value": "En las versiones de Splunk Enterprise inferiores a 9.0.7 y 9.1.2, Splunk Enterprise no sanitiza de forma segura las transformaciones de lenguaje de hojas de estilo extensibles (XSLT) que proporcionan los usuarios. Esto significa que un atacante puede cargar XSLT malicioso, lo que puede provocar la ejecuci\u00f3n remota de c\u00f3digo en la instancia de Splunk Enterprise."}], "id": "CVE-2023-46214", "lastModified": "2024-11-21T08:28:05.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 6.0, "source": "prodsec@splunk.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-11-16T21:15:08.630", "references": [{"source": "prodsec@splunk.com", "tags": ["Vendor Advisory"], "url": "https://advisory.splunk.com/advisories/SVD-2023-1104"}, {"source": "prodsec@splunk.com", "tags": ["Vendor Advisory"], "url": "https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/"}, {"source": "prodsec@splunk.com", "tags": ["Vendor Advisory"], "url": "https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://advisory.splunk.com/advisories/SVD-2023-1104"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/"}], "sourceIdentifier": "prodsec@splunk.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-91"}], "source": "prodsec@splunk.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-91"}], "source": "nvd@nist.gov", "type": "Primary"}]}