CVE-2023-46214

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-91

Affected software

No affected versions have been published.

Timeline

Published
Nov 16, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-462157.5Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logCVE-2023-462169.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462179.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462186.5This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allCVE-2023-462195.3When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file CVE-2023-46227.0A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_sCVE-2023-462209.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462219.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462229.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462239.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462249.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462259.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
CVE-2023-46214: High severity, CVSS 8.8 | Vulnix