Cyber Resilience

CVE-2023-32714

High

Published: 01 June 2023

Published
01 June 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.2067 95.7th percentile
Risk Priority 29 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-32714 is a high-severity Path Traversal: '.../...//' (CWE-35) vulnerability in Splunk Splunk. Its CVSS base score is 8.1 (High).

Operationally, ranked in the top 4.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

The vulnerability CVE-2023-32714 is a path traversal flaw present in the Splunk App for Lookup File Editing in versions below 4.0.1. It is tracked under CWE-22 and CWE-35 and carries a CVSS 3.1 score of 8.1, reflecting network-accessible attack vectors with low complexity and low required privileges.

A low-privileged user can trigger the issue by submitting a specially crafted web request, enabling unauthorized reads and writes within restricted portions of the Splunk installation directory and thereby compromising confidentiality and integrity of the affected instance.

Splunk advisory SVD-2023-0608 and associated research publications direct administrators to upgrade the app to version 4.0.1 or later to remediate the exposure.

The EPSS score rose from lower values after disclosure to a peak of 0.3257 on 2025-12-11 before receding to the current 0.2067, indicating that exploitation interest emerged subsequent to public release.

EU & UK References

Vulnerability details

In the Splunk App for Lookup File Editing versions below 4.0.1, a low-privileged user can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the…

more

Splunk installation directory.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

splunk
splunk
8.1.0 — 8.1.14 · 8.2.0 — 8.2.11 · 9.0.0 — 9.0.5
splunk
splunk app for lookup file editing
≤ 4.0.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

References