CVE-2023-40597CWE-36

Absolute Path Traversal in Splunk Enterprise Using runshellscript.py

High · published August 30, 2023

CVSS v3.1
7.8
EPSS
0%
Percentile
13.5
In the wild
Unconfirmed
What it is

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00234 · 13.5th percentile
Weakness
CWE-36 · Absolute Path Traversal
Published
2023-08-30T16:19Z
EPSS history
Timeline
  • 30 AUG 16:19Z
    Absolute Path Traversal in Splunk Enterprise Using runshellscript.py
    cvelistv5