CVE-2023-32708

HTTP Response Splitting via the ‘rest’ SPL Command

State: Published
Severity: 7.2 High
Published: Jun 1, 2023
Updated: Feb 28, 2025
Reserved: May 11, 2023

Description

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the ‘rest’ SPL command that lets them potentially access other REST endpoints in the system arbitrarily.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	Splunk

Weaknesses

CWE-113 The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	8.1 to before 8.1.14Affected 8.2 to before 8.2.11Affected 9.0 to before 9.0.5Affected
Splunk Cloud PlatformSplunk	- to before 9.0.2303.100Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.