CVE-2023-40596: Splunk Enterprise on Windows Privilege Escalation due to Insecure OPENSSLDIR Build Definition Reference in DLL
First published: Wed Aug 30 2023(Updated: )
In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and subsequently install malicious code to achieve privilege escalation on the Windows machine.
Credit: prodsec@splunk.com prodsec@splunk.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Splunk Splunk | >=8.2.0<8.2.12 | |
| Splunk Splunk | >=9.0.0<9.0.6 | |
| Splunk Splunk | =9.1.0 | |
| Microsoft Windows | ||
| All of | ||
| Any of | ||
| Splunk Splunk | >=8.2.0<8.2.12 | |
| Splunk Splunk | >=9.0.0<9.0.6 | |
| Splunk Splunk | =9.1.0 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-40596?
CVE-2023-40596 is a vulnerability in Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, where a dynamic link library (DLL) references an insecure path for the OPENSSLDIR build definition, allowing an attacker to install malicious code and escalate privileges.
How severe is CVE-2023-40596?
CVE-2023-40596 has a severity value of 8.8, which is considered high.
Which software versions are affected by CVE-2023-40596?
Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1 are affected by CVE-2023-40596.
How can an attacker exploit CVE-2023-40596?
An attacker can exploit CVE-2023-40596 by abusing the insecure path reference in the dynamic link library (DLL) shipped with Splunk Enterprise, allowing them to install malicious code and escalate privileges.
Is Microsoft Windows vulnerable to CVE-2023-40596?
No, Microsoft Windows is not vulnerable to CVE-2023-40596.
- agent/author
- agent/weakness
- agent/type
- agent/event
- agent/first-publish-date
- agent/references
- agent/title
- agent/severity
- agent/description
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/splunk
- canonical/splunk splunk
- version/splunk splunk/8.2.0
- version/splunk splunk/9.0.0
- version/splunk splunk/9.1.0
- vendor/microsoft
- canonical/microsoft windows