by Kastro
Paper/Archive/CVE-2023-32713

CVE-2023-32713

Splunk Splunk App for Stream — Local Privilege Escalation via the ‘streamfwd’ program in Splunk App for Stream

EPSS 0.3%CVSS 9.9
critical.is priorityof 100
35
CVSS 9.9 (NVD)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 25.6.256 × 205.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In Splunk App for Stream versions below 8.1.1, a low-privileged user could use a vulnerability in the streamfwd process within the Splunk App for Stream to escalate their privileges on the machine that runs the Splunk Enterprise instance, up to and including the root user.

Affected

ProductAffectedFixed inSource
Splunk App for Stream8.1 – < 8.1.18.1.1CNA
splunk_app_for_stream8.1 – < 8.1.18.1.1CISA-ADP

Scores by source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Splunk (CNA)7.8CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refadvisory.splunk.com/advisories/SVD-2023-0607