# CVE-2023-46214: Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing

- Exploited (CISA KEV): no
- Published: 2023-11-16
- CVSS: 8 HIGH (v3.1)
- EPSS: 89.2% (100th percentile)
- CWE: CWE-91

In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2023-12-12 | 26 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2023-12-12 · new · rule 200020216
  > Added: signature 200020216 "Splunk Enterprise Malicious XSLT Upload" (Malicious File Upload, risk High), systems: Other Web Server. References: CVE-2023-46214.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2023-46214 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2023-46214