title: Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing
description: In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.
problem types: The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
affected:
{
product: Splunk Enterprise
vendor: Splunk
versions:
version: 9.0, status: affected, versionType: custom, lessThan: 9.0.7
version: 9.1, status: affected, versionType: custom, lessThan: 9.1.2
}
{
product: Splunk Cloud
vendor: Splunk
versions:
version: -, status: affected, versionType: custom, lessThan: 9.1.2308
}
metrics:
cvssV3_1: [
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
baseScore: 8
baseSeverity: HIGH
]
format: CVSS
scenarios: GENERAL