CVE-2023-40597 | THREATINT

Description

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.

Reserved 2023-08-16 | Published 2023-08-30 | Updated 2025-07-01 | Assigner Splunk

HIGH: 7.8CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Problem types

The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as /abs/path that can resolve to a location that is outside of that directory.

Product status

8.2 before 8.2.12

affected

9.0 before 9.0.6

affected

9.1 before 9.1.1

affected

- before 9.0.2305.200

affected

Credits

Danylo Dmytriiev (DDV_UA)

References

advisory.splunk.com/advisories/SVD-2023-0806

research.splunk.com/...356bd3fe-f59b-4f64-baa1-51495411b7ad/

cve.org (CVE-2023-40597)

nvd.nist.gov (CVE-2023-40597)

Download JSON