CVE-2023-46213

Description

In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web browser.

Reserved 2023-10-18 | Published 2023-11-16 | Updated 2025-01-02 | Assigner Splunk

Problem types

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Product status

9.0 before 9.0.7
affected

9.1 before 9.1.2
affected

- before 9.1.2308
affected

Credits

Joshua Neubecker

References

advisory.splunk.com/advisories/SVD-2023-1103

research.splunk.com/...1030bc63-0b37-4ac9-9ae0-9361c955a3cc/

cve.org (CVE-2023-46213)

nvd.nist.gov (CVE-2023-46213)

Download JSON