CVE-2023-40593
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed SAML request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.
Risk Assessment
An attacker can cause the Splunk service to become unavailable, impacting the organization's operations and potentially leading to data loss.
Recommendation
It is recommended to upgrade to Splunk Enterprise version 9.0.6 or 8.2.12 to mitigate the risk associated with this vulnerability.
Original NVD description (English source)
In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.