CVE-2023-32706: Denial Of Service due to Untrusted XML Tag in XML Parser within SAML Authentication
Published Jun 1, 2023
·Updated
On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an unauthenticated attacker can send specially-crafted messages to the XML parser within SAML authentication to cause a denial of service in the Splunk daemon.
Affected Software
4 affected components
Splunk splunk>=8.1.0<8.1.14
Splunk splunk>=8.2.0<8.2.11
Splunk splunk>=9.0.0<9.0.5
Splunk Splunk Cloud Platform<9.0.2303.100
Event History
Jun 1, 2023
CVE Published
via MITRE·04:34 PM
Data Sourced
via MITRE·04:34 PM
DescriptionSeverityWeakness
Data Sourced
05:15 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2023-32706.
2
Which versions of Splunk Enterprise are affected?
Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14 are affected.
3
What is the severity of CVE-2023-32706?
CVE-2023-32706 has a severity rating of 6.5 (High).
4
How can an attacker exploit this vulnerability?
An unauthenticated attacker can send specially-crafted messages to the XML parser within SAML authentication to cause a denial of service in the Splunk daemon.
5
How can I fix CVE-2023-32706?
To fix CVE-2023-32706, upgrade to Splunk Enterprise version 9.0.5, 8.2.11, or 8.1.14.