"High-Severity Vulnerabilities Patched in Splunk Enterprise"

Splunk recently announced Splunk Enterprise security updates that resolve multiple high-severity vulnerabilities, including some impacting third-party packages used by the product.  The most severe of these is CVE-2023-32707, a privilege escalation issue that allows low-privileged users with the "edit_user" capability to escalate privileges to administrator via a specially crafted web request.  Splunk explained that this can happen because the "edit_user" capability does not honor the "grantableRoles" setting in the authorize.conf configuration file, which prevents this scenario from happening.  The next most severe vulnerability patched is CVE-2023-32706, a denial-of-service (DoS) flaw in the Splunk daemon, which occurs when an incorrectly configured XML parser receives specially-crafted messages within SAML authentication.  Splunk explained that the input contains a reference to an entity expansion, and recursive references may cause the XML parser to use all available memory on the machine, leading to the daemon's crash or to process termination.  Another high-severity vulnerability addressed in Splunk Enterprise is CVE-2023-32708, an HTTP response splitting issue that allows a low-privileged user to access other REST endpoints on the system and view restricted content.  Splunk also resolved multiple severe issues in third-party packages used in Splunk Enterprise, such as Libxml2, OpenSSL, Curl, Libarchive, SQLite, Go, and many others.  Some of these vulnerabilities have been public for more than four years.  Splunk noted that all these flaws were addressed with the release of Splunk Enterprise versions 8.1.14, 8.2.11, and 9.0.5.  The updates resolve multiple medium-severity vulnerabilities as well.

SecurityWeek reports: "High-Severity Vulnerabilities Patched in Splunk Enterprise"