« Volver al listado

CVE-2023-40593

Estado: ModificadaAlta (7.5)—

In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Splunk — SplunkSplunk — Splunk Cloud Platform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-40593",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "prodsec@splunk.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "prodsec@splunk.com",
      "affectedData": [
        {
          "vendor": "Splunk",
          "product": "Splunk Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "8.2",
              "lessThan": "8.2.12",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.0",
              "lessThan": "9.0.6",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Splunk",
          "product": "Splunk Cloud",
          "versions": [
            {
              "status": "affected",
              "version": "-",
              "lessThan": "9.0.2205",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-08-30T17:15:09.853",
  "references": [
    {
      "url": "https://advisory.splunk.com/advisories/SVD-2023-0802",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "prodsec@splunk.com"
    },
    {
      "url": "https://research.splunk.com/application/8e8a86d5-f323-4567-95be-8e817e2baee6/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "prodsec@splunk.com"
    },
    {
      "url": "https://advisory.splunk.com/advisories/SVD-2023-0802",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://research.splunk.com/application/8e8a86d5-f323-4567-95be-8e817e2baee6/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "prodsec@splunk.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon."
    },
    {
      "lang": "es",
      "value": "En las versiones de Splunk Enterprise inferiores a la 9.0.6 y 8.2.12, un actor malicioso puede enviar una solicitud de Security Assertion Markup Language (SAML) malformada al endpoint REST `/saml/acs`, lo que puede causar una denegación de servicio a través de un fallo o bloqueo del demonio de Splunk."
    }
  ],
  "lastModified": "2026-06-17T06:18:37.693",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21F6F824-393F-424F-85DF-CD3FCB40452F",
              "versionEndExcluding": "8.2.12",
              "versionStartIncluding": "8.2.0"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74A23E71-6A34-48A5-8087-B626BED870E0",
              "versionEndExcluding": "9.0.6",
              "versionStartIncluding": "9.0.0"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2A0FF7F-1171-42D4-A27B-689541F4BC32",
              "versionEndIncluding": "9.0.2305.100"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "prodsec@splunk.com"
}