{"id":"CVE-2023-32707","aliases":["EUVD-2023-36934","GHSA-m653-m4xm-rxrr"],"status":"published","title":"‘edit_user’ Capability Privilege Escalation","description":"In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.78658,"percentile":0.99591,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-285"],"published":"2023-06-01T16:34:30Z","modified":"2026-06-17T05:59:25Z","exploits":[{"source":"exploitdb","id":"EDB-51747","title":"Splunk 9.0.5 - admin account take over","type":"webapps","platform":"multiple","date":"2023-10-09","url":"https://www.exploit-db.com/exploits/51747"},{"source":"metasploit","id":"exploit/multi/http/splunk_privilege_escalation_cve_2023_32707","title":"Splunk \"edit_user\" Capability Privilege Escalation","type":"exploit","platform":"Linux,Unix,Windows","date":"2023-06-01","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/splunk_privilege_escalation_cve_2023_32707"},{"source":"pocgithub","id":"9xN/CVE-2023-32707","title":"9xN/CVE-2023-32707","date":"2023-11-14","url":"https://github.com/9xN/CVE-2023-32707"}],"products":[{"vendor":"splunk","product":"splunk"},{"vendor":"splunk","product":"splunk cloud platform"},{"vendor":"splunk","product":"splunk enterprise"},{"vendor":"splunk","product":"splunk_cloud_platform"}],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2023-0602","tags":["x_transferred","Vendor Advisory"]},{"url":"https://research.splunk.com/application/39e1c326-67d7-4c0d-8584-8056354f6593/","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32707"},{"url":"http://packetstormsecurity.com/files/174602/Splunk-Enterprise-Account-Takeover.html"},{"url":"http://packetstormsecurity.com/files/175386/Splunk-edit_user-Capability-Privilege-Escalation.html"},{"url":"https://research.splunk.com/application/39e1c326-67d7-4c0d-8584-8056354f6593"},{"url":"https://github.com/advisories/GHSA-m653-m4xm-rxrr"}],"sources":{"cve":[{"id":"CVE-2023-32707","title":"‘edit_user’ Capability Privilege Escalation","description":"In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.","status":"published","published":"2023-06-01T16:34:30.607Z","modified":"2025-03-11T15:02:44.575Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:35:29.01154Z"}],"euvd":[{"id":"EUVD-2023-36934","description":"In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.","status":"published","published":"2023-06-01T16:34:30Z","modified":"2025-03-11T15:02:44Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:07.779422Z"}],"ghsa":[{"id":"GHSA-m653-m4xm-rxrr","title":"In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below...","description":"In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.","status":"published","published":"2023-07-06T21:15:06Z","modified":"2024-04-04T05:48:09Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:56:36.004809Z"}],"nvd":[{"id":"CVE-2023-32707","description":"In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.","status":"published","published":"2023-06-01T17:15:10.117Z","modified":"2026-06-17T05:59:25.687Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:08:03.795015Z"}]}}