Riskcovery

CVE-2023-40597

Absolute Path Traversal in Splunk Enterprise Using runshellscript.py

State
Published
Severity
7.8 High
Published
Aug 30, 2023
Updated
Jul 1, 2025
Reserved
Aug 16, 2023

Read the record on cve.org

Description

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HSplunk

Weaknesses

  • CWE-36 The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as /abs/path that can resolve to a location that is outside of that directory.

Affected Products

ProductVersions
Splunk EnterpriseSplunk
  • 8.2 to before 8.2.12Affected
  • 9.0 to before 9.0.6Affected
  • 9.1 to before 9.1.1Affected
Splunk CloudSplunk
  • - to before 9.0.2305.200Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.