CVE-2023-32707: ‘edit_user’ Capability Privilege Escalation
First published: Thu Jun 01 2023(Updated: )
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.
Credit: Redway Security prodsec@splunk.com prodsec@splunk.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Splunk Splunk | >=8.1.0<8.1.14 | |
| Splunk Splunk | >=8.2.0<8.2.11 | |
| Splunk Splunk | >=9.0.0<9.0.5 | |
| Splunk Splunk Cloud Platform | <9.0.2303.100 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Splunk Enterprise vulnerability?
The vulnerability ID for this Splunk Enterprise vulnerability is CVE-2023-32707.
What is the severity of CVE-2023-32707?
The severity of CVE-2023-32707 is high with a severity value of 8.8.
Which versions of Splunk Enterprise are affected by CVE-2023-32707?
Versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14 are affected by CVE-2023-32707.
How can a low-privileged user escalate their privileges to that of the admin user in Splunk Enterprise?
A low-privileged user can escalate their privileges to that of the admin user in Splunk Enterprise by providing specially crafted web requests.
Are Splunk Cloud Platform versions affected by CVE-2023-32707?
Yes, Splunk Cloud Platform versions below 9.0.2303.100 are affected by CVE-2023-32707.
- collector/nvd-latest
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- exploited/true
- collector/exploitdb-recent
- source/ExploitDB
- alias/CVE-2023-32707
- agent/weakness
- agent/references
- agent/title
- agent/author
- agent/severity
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/splunk
- canonical/splunk splunk
- version/splunk splunk/8.1.0
- version/splunk splunk/8.2.0
- version/splunk splunk/9.0.0
- canonical/splunk splunk cloud platform