Main
Vulnerability Database
Exploits
ID:10707 - Exploit for Improper Authorization in Splunk Enterprise - CVE-2023-32707
ID:10707 - Exploit for Improper Authorization in Splunk Enterprise - CVE-2023-32707
Published: October 25, 2024
Vulnerability identifier: #VU76914
Vulnerability risk: Medium
CVE-ID: CVE-2023-32707
CWE-ID: CWE-285
Exploitation vector: Remote access
Vulnerable software:
Splunk Enterprise
Splunk Enterprise
Link to public exploit:
Vulnerability description
The vulnerability allows a remote user to escalate privileges within the application.
The
vulnerability exists due to application does not honor the "grantableRoles" setting in the authorize.conf configuration file. A remote user with "edit_user" capability can send a specially crafted HTTP request and obtain administrative privileges within the application.
Remediation
Install updates from vendor's website.