CVE-2023-40596: Splunk Enterprise on Windows Privilege Escalation due to Insecure OPENSSLDIR Build Definition Reference in DLL
In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and subsequently install malicious code to achieve privilege escalation on the Windows machine.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-40596?
CVE-2023-40596 is a vulnerability in Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, where a dynamic link library (DLL) references an insecure path for the OPENSSLDIR build definition, allowing an attacker to install malicious code and escalate privileges.
How severe is CVE-2023-40596?
CVE-2023-40596 has a severity value of 8.8, which is considered high.
Which software versions are affected by CVE-2023-40596?
Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1 are affected by CVE-2023-40596.
How can an attacker exploit CVE-2023-40596?
An attacker can exploit CVE-2023-40596 by abusing the insecure path reference in the dynamic link library (DLL) shipped with Splunk Enterprise, allowing them to install malicious code and escalate privileges.
Is Microsoft Windows vulnerable to CVE-2023-40596?
No, Microsoft Windows is not vulnerable to CVE-2023-40596.