HTTP Response Splitting via the ‘rest’ SPL Command

CVE-2023-32708

Summary

In certain versions of Splunk Enterprise and Splunk Cloud Platform, low-privileged users may exploit an HTTP response splitting vulnerability. By using the ‘rest’ SPL command, these users can inadvertently manipulate HTTP responses, potentially gaining unauthorized access to REST endpoints within the system. This flaw affects various versions of Splunk products, emphasizing the importance of implementing security measures and applying updates promptly to mitigate risk.

References