CVE-2023-32716

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, an attacker can exploit a vulnerability in the {{dump}} SPL command to cause a denial of service by crashing the Splunk daemon.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-754

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-327174.3On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized use CVE-2023-32727.5Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive information by interc CVE-2023-327215.4A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.CVE-2023-327227.8The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open.CVE-2023-327239.1Request to LDAP is sent before user permissions are checked.CVE-2023-327248.8Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulat CVE-2023-327258.8The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session coo CVE-2023-327268.1The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.CVE-2023-327277.2An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execu CVE-2023-327289.8The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulner CVE-2023-32737.5Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by chan CVE-2023-327317.5When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutat