Vulnerability Description
In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and subsequently install malicious code to achieve privilege escalation on the Windows machine.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk | >= 8.2.0, < 8.2.12 |
| Microsoft | Windows | - |
Related Weaknesses (CWE)
References
- https://advisory.splunk.com/advisories/SVD-2023-0805Vendor Advisory
- https://advisory.splunk.com/advisories/SVD-2023-0805Vendor Advisory
FAQ
What is CVE-2023-40596?
CVE-2023-40596 is a vulnerability with a CVSS score of 7.0 (HIGH). In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An ...
How severe is CVE-2023-40596?
CVE-2023-40596 has been rated HIGH with a CVSS base score of 7.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-40596?
Check the references section above for vendor advisories and patch information. Affected products include: Splunk Splunk, Microsoft Windows.