topic How we can resolve this RCE in Splunk Enterprise through Insecure XML Parsing issue in Security

How we can resolve this RCE in Splunk Enterprise through Insecure XML Parsing issue

AL3Z — Wed, 22 Nov 2023 06:26:09 GMT

Hi,

We have been informed about a high-severity vulnerability (CVE-2023-46214) impacting Splunk Enterprise (RCE in Splunk Enterprise through Insecure XML Parsing) as we are on Splunk Cloud Version:9.0.2303.201.

Thanks..

Re: How we can resolve this RCE in Splunk Enterprise through Insecure XML Parsing issue

inventsekar — Wed, 22 Nov 2023 07:25:11 GMT

Hi @AL3Z ..

Please check this Splunk Advisory:

https://advisory.splunk.com/advisories/SVD-2023-1104

the Splunk Cloud affected version is - Versions below 9.1.2308

The Splunk Cloud fix version is --------- 9.1.2308

So you should ask the Splunk Cloud Support and ask them to upgrade your Splunk Cloud to the fix version 9.1.2308, thanks.

Re: How we can resolve this RCE in Splunk Enterprise through Insecure XML Parsing issue

AL3Z — Tue, 28 Nov 2023 12:40:50 GMT

@inventsekar ,

They recommended upgrading or updating the web.conf file in on-prem environment.
How we can do this as its not the cloud its an enterprise.