CVE-2023-32707

CVSS V2 None CVSS V3 None

Description

In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.

Overview

CVE ID
CVE-2023-32707

Assigner
Splunk

Vulnerability Status
PUBLISHED

Published Version
2023-06-01T16:34:30.607Z

Last Modified Date
2024-04-10T00:53:13.507Z

Weakness Enumerations

CWE	URL
CWE-285	http://cwe.mitre.org/data/definitions/285.html

References

Reference URL	Reference Tags
https://advisory.splunk.com/advisories/SVD-2023-0602
https://research.splunk.com/application/39e1c326-67d7-4c0d-8584-8056354f6593/

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-32707
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32707

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 11:50:54				Added to TrackCVE