CVE-2023-32708 — HTTP Request/Response Splitting in Cloud Platform

CWE-113 — HTTP Request/Response SplittingCWE-436 — Interpretation Conflict3 documents3 sources
Severity
8.8HIGHNVD
CNA7.2
EPSS
0.2%
top 58.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Splunk Cloud PlatformSplunk EnterpriseSplunk
Timeline
PublishedJun 1
Latest updateJul 6

Description

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the ‘rest’ SPL command that lets them potentially access other REST endpoints in the system arbitrarily.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5splunk/splunk_cloud_platform- — 9.0.2303.100
▶NVDsplunk/splunk_cloud_platform< 9.0.2303.100
▶CVEListV5splunk/splunk_enterprise8.1 — 8.1.14+2
▶NVDsplunk/splunk8.1.0 — 8.1.14+2

🔴Vulnerability Details

2
GHSA
GHSA-8v6j-9rv8-9mrh: In Splunk Enterprise versions below 9↗2023-07-06
▶
CVEList
HTTP Response Splitting via the ‘rest’ SPL Command↗2023-06-01
▶
CVE-2023-32708 — HTTP Request/Response Splitting | cvebase