CVE-2023-32713 Vulnerability Details

  /     /     /  

CVE-2023-32713 Metadata Quick Info

CVE Published: 01/06/2023 | CVE Updated: 30/10/2024 | CVE Year: 2023
Source: Splunk | Vendor: Splunk | Product: Splunk App for Stream
Status : PUBLISHED

---

CVE-2023-32713 Description

In Splunk App for Stream versions below 8.1.1, a low-privileged user could use a vulnerability in the streamfwd process within the Splunk App for Stream to escalate their privileges on the machine that runs the Splunk Enterprise instance, up to and including the root user.

Metrics

CVSS Version: 3.1 | Base Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-269
CWE Name: The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Source: Splunk

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).