CVE-2023-40597

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-36 CWE-22

Affected software

Vendor	Product	Versions
Splunk	Splunk Enterprise	>= 8.2, < 8.2.12; >= 9.0, < 9.0.6; >= 9.1, < 9.1.1
Splunk	Splunk Cloud	>= -, < 9.0.2305.200

References

https://advisory.splunk.com/advisories/SVD-2023-0806Vendor Advisory
https://research.splunk.com/application/356bd3fe-f59b-4f64-baa1-51495411b7ad/Vendor Advisory
https://advisory.splunk.com/advisories/SVD-2023-0806Vendor Advisory
https://research.splunk.com/application/356bd3fe-f59b-4f64-baa1-51495411b7ad/Vendor Advisory

Timeline

Published: Aug 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-405988.8In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal functio CVE-2023-405997.5Regular expression Denial-of-Service (ReDoS) exists in multiple add-ons for Mailform Pro CGI 4.3.1.3 and earlier, which allows a remote unau CVE-2023-40604.8The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2023-406007.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer. It works only when debug.log i CVE-2023-406016.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <= 2.0.7 versions.CVE-2023-406026.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinde CVE-2023-406035.3Missing Authorization vulnerability in Gangesh Matta Simple Org Chart.This issue affects Simple Org Chart: from n/a through 2.3.4.CVE-2023-406044.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jes Madsen Cookies by JM plugin <= 1.0 versions.CVE-2023-406055.4Auth. (contributor) Cross-Site Scripting (XSS) vulnerability in 93digital Typing Effect plugin <= 1.3.6 versions.CVE-2023-406067.2Improper Control of Generation of Code ('Code Injection') vulnerability in Kanban for WordPress Kanban Boards for WordPress.This issue affec CVE-2023-406078.8Cross-Site Request Forgery (CSRF) vulnerability in CLUEVO CLUEVO LMS, E-Learning Platform plugin <= 1.10.0 versions.CVE-2023-406088.2Missing Authorization vulnerability in Paid Memberships Pro Paid Memberships Pro CCBill Gateway.This issue affects Paid Memberships Pro CCBi