CVE-2023-46231

HIGH Year: 2023
CVSS v3 Score
7.2
High
Weakness Type
CWE-532
View all →

Vulnerability Description

In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the Splunk Add-on Builder or when you build or edit a custom app or add-on.

Related Vulnerabilities

CVE-2024-29945

HIGH
CVSS:7.2(High)

In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the software potentially exposes authentication tokens during the token validation process. This exposure happens when either Splunk Enterp...

CWE-5322024

CVE-2024-6451

HIGH
CVSS:7.2(High)

AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file extension of "logs_path", allowing Administrat...

CWE-5322024

CVE-2022-20806

HIGH
CVSS:7.1(High)

Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker...

CWE-5322022

CVE-2024-24272

HIGH
CVSS:7.1(High)

An issue in iTop DualSafe Password Manager & Digital Vault before 1.4.24 allows a local attacker to obtain sensitive information via leaked credentials as plaintext in a log file that can be accessed ...

CWE-5322024

CVE-2024-28186

HIGH
CVSS:7.1(High)

FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization ...

CWE-5322024

CVE-2025-20231

HIGH
CVSS:7.1(High)

In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not ...

CWE-5322025