{"id":"CVE-2023-46214","published":"2023-11-16T20:15:25Z","modified":"2025-12-16T18:23:23Z","title":"Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing","vendor":"Splunk","product":"Splunk Enterprise","tier":"core","eol":null,"affectedVersions":[{"vendor":"Splunk","product":"Splunk Enterprise","versions":[">= 9.0, < 9.0.7",">= 9.1, < 9.1.2"]},{"vendor":"Splunk","product":"Splunk Cloud","versions":[">= -, < 9.1.2308"]}],"description":{"text":"In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in Splunk Enterprise's handling of user-supplied XSLT (extensible stylesheet language transformations) fails to sanitise that input, affecting the product's XML processing functionality. An attacker who can upload a malicious XSLT file can achieve remote code execution on the Splunk Enterprise instance, requiring network access, low privileges, and user interaction, with high complexity to exploit.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:05Z"},"cvss":{"score":8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.89174,"percentile":0.9978,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-91","name":"XML Injection"}],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2023-1104","tags":[]},{"url":"https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/","tags":[]},{"url":"https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-50457","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-50457","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Splunk Authenticated XSLT Upload RCE","module":"exploit/unix/http/splunk_xslt_authenticated_rce","type":"exploit","disclosureDate":"2023-11-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/splunk_xslt_authenticated_rce.rb"}],"first":{"date":"2023-11-28","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/splunk_xslt_authenticated_rce.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"Exploitation Attempt Of CVE-2023-46214 Using Public POC Code","id":"ba5268de-4dd4-4d5c-8a90-2b5e6dc1aff8","level":"high","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise_poc.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise_poc.yml","techniques":["T1210"]},{"title":"Potential CVE-2023-46214 Exploitation Attempt","id":"04017cd5-621e-4ec4-a762-1f042fe3d3e5","level":"medium","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise.yml","techniques":["T1210"]}]},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-11-16","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-46214","provenance":"source"},{"date":"2023-11-28","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/splunk_xslt_authenticated_rce.rb","provenance":"source"}],"speed":{"daysToPublicExploit":12,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":30.6,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9978"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.6,"detail":"base score 8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}