Vulnerability · Published Jun 1, 2023 · Assigned by Splunk
CVE-2023-32707‘edit_user’ Capability Privilege Escalation
High 8.8
In plain English
A high-severity security flaw in Splunk Cloud Platform from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 78.7% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code.
Official description
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 8.1 – before 8.1.148.2 – before 8.2.119.0 – before 9.0.5 |
| Splunk | Splunk Cloud Platform | - – before 9.0.2303.100 |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H