CVE-2023-46230

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

In Splunk Add-on Builder versions below 4.1.4, the app writes sensitive information to internal log files.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

VendorProductVersions
SplunkSplunk Add-on Builder>= -, < 4.1.4

References

Timeline

Published
Jan 30, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-462317.2In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the SplunCVE-2023-462325.3era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to CVE-2023-462339.1crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specifCVE-2023-462347.5browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's CVE-2023-462356.1FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanCVE-2023-462367.5FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (CVE-2023-462375.3FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer lCVE-2023-462385.4ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types includingCVE-2023-462397.5quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frameCVE-2023-46242.4Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.CVE-2023-462407.5CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error reportCVE-2023-462418.1`discourse-microsoft-auth` is a plugin that enables authentication via Microsoft. On sites with the `discourse-microsoft-auth` plugin enable
CVE-2023-46230: Medium severity, CVSS 4.9 | Vulnix