Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2024-AVI-0878
Vulnerability from certfr_avis - Published: 2024-10-15 - Updated: 2024-10-15
De multiples vulnérabilités ont été découvertes dans les produits Splunk. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Splunk | Splunk Enterprise | Splunk Entreprise versions 9.2.x antérieures à 9.2.3 | ||
| Splunk | Splunk Enterprise | Splunk Entreprise versions 9.1.x antérieures à 9.1.6 | ||
| Splunk | Splunk Enterprise | Splunk Entreprise versions 9.3.x antérieures à 9.3.1 | ||
| Splunk | Splunk Cloud Platform | Splunk Cloud Platform versions 9.1.2308.x antérieures à 9.1.2308.208 | ||
| Splunk | Splunk Cloud Platform | Splunk Cloud Platform versions 9.1.2312.x antérieures à 9.1.2312.205 | ||
| Splunk | Splunk Cloud Platform | Splunk Cloud Platform versions 9.2.2403.x antérieures à 9.2.2403.108 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Splunk Entreprise versions 9.2.x ant\u00e9rieures \u00e0 9.2.3",
"product": {
"name": "Splunk Enterprise",
"vendor": {
"name": "Splunk",
"scada": false
}
}
},
{
"description": "Splunk Entreprise versions 9.1.x ant\u00e9rieures \u00e0 9.1.6",
"product": {
"name": "Splunk Enterprise",
"vendor": {
"name": "Splunk",
"scada": false
}
}
},
{
"description": "Splunk Entreprise versions 9.3.x ant\u00e9rieures \u00e0 9.3.1",
"product": {
"name": "Splunk Enterprise",
"vendor": {
"name": "Splunk",
"scada": false
}
}
},
{
"description": "Splunk Cloud Platform versions 9.1.2308.x ant\u00e9rieures \u00e0 9.1.2308.208",
"product": {
"name": "Splunk Cloud Platform",
"vendor": {
"name": "Splunk",
"scada": false
}
}
},
{
"description": "Splunk Cloud Platform versions 9.1.2312.x ant\u00e9rieures \u00e0 9.1.2312.205",
"product": {
"name": "Splunk Cloud Platform",
"vendor": {
"name": "Splunk",
"scada": false
}
}
},
{
"description": "Splunk Cloud Platform versions 9.2.2403.x ant\u00e9rieures \u00e0 9.2.2403.108",
"product": {
"name": "Splunk Cloud Platform",
"vendor": {
"name": "Splunk",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-24790",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24790"
},
{
"name": "CVE-2017-14159",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14159"
},
{
"name": "CVE-2024-37891",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37891"
},
{
"name": "CVE-2020-36230",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36230"
},
{
"name": "CVE-2024-45733",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45733"
},
{
"name": "CVE-2023-45142",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45142"
},
{
"name": "CVE-2020-36221",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36221"
},
{
"name": "CVE-2024-45731",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45731"
},
{
"name": "CVE-2019-13057",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13057"
},
{
"name": "CVE-2023-45283",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45283"
},
{
"name": "CVE-2023-29401",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29401"
},
{
"name": "CVE-2023-45288",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45288"
},
{
"name": "CVE-2015-3276",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-3276"
},
{
"name": "CVE-2020-36225",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36225"
},
{
"name": "CVE-2024-45739",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45739"
},
{
"name": "CVE-2023-39321",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39321"
},
{
"name": "CVE-2023-45285",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45285"
},
{
"name": "CVE-2023-45284",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45284"
},
{
"name": "CVE-2020-36224",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36224"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2024-24557",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24557"
},
{
"name": "CVE-2021-27212",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27212"
},
{
"name": "CVE-2020-36228",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36228"
},
{
"name": "CVE-2020-36227",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36227"
},
{
"name": "CVE-2024-28180",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28180"
},
{
"name": "CVE-2020-15719",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15719"
},
{
"name": "CVE-2024-45740",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45740"
},
{
"name": "CVE-2024-45736",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45736"
},
{
"name": "CVE-2023-48795",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-48795"
},
{
"name": "CVE-2023-39320",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39320"
},
{
"name": "CVE-2017-17740",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-17740"
},
{
"name": "CVE-2024-45741",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45741"
},
{
"name": "CVE-2020-12243",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12243"
},
{
"name": "CVE-2023-39318",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39318"
},
{
"name": "CVE-2020-36223",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36223"
},
{
"name": "CVE-2023-3978",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3978"
},
{
"name": "CVE-2024-45737",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45737"
},
{
"name": "CVE-2020-36229",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36229"
},
{
"name": "CVE-2023-45803",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45803"
},
{
"name": "CVE-2023-39319",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39319"
},
{
"name": "CVE-2024-45732",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45732"
},
{
"name": "CVE-2022-29155",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29155"
},
{
"name": "CVE-2024-35195",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35195"
},
{
"name": "CVE-2024-45735",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45735"
},
{
"name": "CVE-2023-50658",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50658"
},
{
"name": "CVE-2023-47108",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-47108"
},
{
"name": "CVE-2023-26125",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26125"
},
{
"name": "CVE-2023-43804",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43804"
},
{
"name": "CVE-2024-45738",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45738"
},
{
"name": "CVE-2020-36226",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36226"
},
{
"name": "CVE-2020-36222",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36222"
},
{
"name": "CVE-2023-39322",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39322"
},
{
"name": "CVE-2022-42969",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42969"
},
{
"name": "CVE-2023-2953",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2953"
},
{
"name": "CVE-2019-13565",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13565"
},
{
"name": "CVE-2023-39323",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39323"
},
{
"name": "CVE-2023-39326",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39326"
},
{
"name": "CVE-2023-39325",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39325"
},
{
"name": "CVE-2024-24786",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24786"
},
{
"name": "CVE-2024-45734",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45734"
},
{
"name": "CVE-2020-25692",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25692"
}
],
"initial_release_date": "2024-10-15T00:00:00",
"last_revision_date": "2024-10-15T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0878",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-10-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Splunk. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Splunk",
"vendor_advisories": [
{
"published_at": "2024-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1008",
"url": "https://advisory.splunk.com/advisories/SVD-2024-1008"
},
{
"published_at": "2024-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1005",
"url": "https://advisory.splunk.com/advisories/SVD-2024-1005"
},
{
"published_at": "2024-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1006",
"url": "https://advisory.splunk.com/advisories/SVD-2024-1006"
},
{
"published_at": "2024-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1002",
"url": "https://advisory.splunk.com/advisories/SVD-2024-1002"
},
{
"published_at": "2024-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1003",
"url": "https://advisory.splunk.com/advisories/SVD-2024-1003"
},
{
"published_at": "2024-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1007",
"url": "https://advisory.splunk.com/advisories/SVD-2024-1007"
},
{
"published_at": "2024-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1004",
"url": "https://advisory.splunk.com/advisories/SVD-2024-1004"
},
{
"published_at": "2024-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1010",
"url": "https://advisory.splunk.com/advisories/SVD-2024-1010"
},
{
"published_at": "2024-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1011",
"url": "https://advisory.splunk.com/advisories/SVD-2024-1011"
},
{
"published_at": "2024-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1012",
"url": "https://advisory.splunk.com/advisories/SVD-2024-1012"
},
{
"published_at": "2024-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1009",
"url": "https://advisory.splunk.com/advisories/SVD-2024-1009"
},
{
"published_at": "2024-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1001",
"url": "https://advisory.splunk.com/advisories/SVD-2024-1001"
}
]
}
CVE-2024-45731 (GCVE-0-2024-45731)
Vulnerability from cvelistv5 – Published: 2024-10-14 16:46 – Updated: 2025-02-28 11:03
VLAI
EPSS
Title
Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk
Summary
In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-23 - The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Splunk | Splunk Enterprise |
Affected:
9.3 , < 9.3.1
(custom)
Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) |
|
| splunk | splunk_enterprise |
Affected:
9.3 , < 9.3.1
(custom)
Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:* |
Date Public
2024-10-14 00:00
Credits
Alex Hordijk (hordalex)
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "splunk_enterprise",
"vendor": "splunk",
"versions": [
{
"lessThan": "9.3.1",
"status": "affected",
"version": "9.3",
"versionType": "custom"
},
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
},
{
"lessThan": "9.1.6",
"status": "affected",
"version": "9.1",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45731",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-15T17:38:45.988147Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-15T17:39:52.042Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Splunk Enterprise",
"vendor": "Splunk",
"versions": [
{
"lessThan": "9.3.1",
"status": "affected",
"version": "9.3",
"versionType": "custom"
},
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
},
{
"lessThan": "9.1.6",
"status": "affected",
"version": "9.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Alex Hordijk (hordalex)"
}
],
"datePublic": "2024-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive."
}
],
"value": "In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-28T11:03:47.249Z",
"orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"shortName": "Splunk"
},
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2024-1001"
},
{
"url": "https://research.splunk.com/application/c97e0704-d9c6-454d-89ba-1510a987bf72/"
}
],
"source": {
"advisory": "SVD-2024-1001"
},
"title": "Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk"
}
},
"cveMetadata": {
"assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"assignerShortName": "Splunk",
"cveId": "CVE-2024-45731",
"datePublished": "2024-10-14T16:46:01.751Z",
"dateReserved": "2024-09-05T21:35:21.290Z",
"dateUpdated": "2025-02-28T11:03:47.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45732 (GCVE-0-2024-45732)
Vulnerability from cvelistv5 – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03
VLAI
EPSS
Title
Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app
Summary
In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Splunk | Splunk Enterprise |
Affected:
9.3 , < 9.3.1
(custom)
Affected: 9.2 , < 9.2.3 (custom) |
|
| Splunk | Splunk Cloud Platform |
Affected:
9.2.2403 , < 9.2.2403.103
(custom)
Affected: 9.1.2312 , < 9.1.2312.110, 9.1.2312.200 (custom) Affected: 9.1.2308 , < 9.1.2308.208 (custom) |
|
| splunk | splunk_enterprise |
Affected:
9.3 , < 9.3.1
(custom)
Affected: 9.2 , < 9.2.3 (custom) cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:* |
|
| splunk | splunk_cloud_platform |
Affected:
9.2.2403 , < 9.2.2403.103
(custom)
Affected: 9.1.2312 , < 9.1.2312.200 (custom) Unaffected: 9.1.2312.110 Affected: 9.1.2308 , < 9.1.2308.208 (custom) cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:* |
Date Public
2024-10-14 00:00
Credits
Anton (therceman)
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "splunk_enterprise",
"vendor": "splunk",
"versions": [
{
"lessThan": "9.3.1",
"status": "affected",
"version": "9.3",
"versionType": "custom"
},
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "splunk_cloud_platform",
"vendor": "splunk",
"versions": [
{
"lessThan": "9.2.2403.103",
"status": "affected",
"version": "9.2.2403",
"versionType": "custom"
},
{
"lessThan": "9.1.2312.200",
"status": "affected",
"version": "9.1.2312",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.1.2312.110"
},
{
"lessThan": "9.1.2308.208",
"status": "affected",
"version": "9.1.2308",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45732",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-15T16:30:27.363227Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-15T16:34:10.045Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Splunk Enterprise",
"vendor": "Splunk",
"versions": [
{
"lessThan": "9.3.1",
"status": "affected",
"version": "9.3",
"versionType": "custom"
},
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
}
]
},
{
"product": "Splunk Cloud Platform",
"vendor": "Splunk",
"versions": [
{
"lessThan": "9.2.2403.103",
"status": "affected",
"version": "9.2.2403",
"versionType": "custom"
},
{
"lessThan": "9.1.2312.110, 9.1.2312.200",
"status": "affected",
"version": "9.1.2312",
"versionType": "custom"
},
{
"lessThan": "9.1.2308.208",
"status": "affected",
"version": "9.1.2308",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Anton (therceman)"
}
],
"datePublic": "2024-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could run a search as the \"nobody\" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data."
}
],
"value": "In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could run a search as the \"nobody\" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "The software does not perform an authorization check when an actor attempts to access a resource or perform an action.",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-28T11:03:50.807Z",
"orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"shortName": "Splunk"
},
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2024-1002"
},
{
"url": "https://research.splunk.com/application/f765c3fe-c3b6-4afe-a932-11dd4f3a024f/"
}
],
"source": {
"advisory": "SVD-2024-1002"
},
"title": "Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app"
}
},
"cveMetadata": {
"assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"assignerShortName": "Splunk",
"cveId": "CVE-2024-45732",
"datePublished": "2024-10-14T17:03:35.668Z",
"dateReserved": "2024-09-05T21:35:21.290Z",
"dateUpdated": "2025-02-28T11:03:50.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45733 (GCVE-0-2024-45733)
Vulnerability from cvelistv5 – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03
VLAI
EPSS
Title
Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows
Summary
In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-502 - The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Splunk | Splunk Enterprise |
Affected:
9.2 , < 9.2.3
(custom)
Affected: 9.1 , < 9.1.6 (custom) |
|
| splunk | splunk_enterprise |
Affected:
9.1 , < 9.1.6
(custom)
Affected: 9.2 , < 9.2.3 (custom) cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:* |
Date Public
2024-10-14 00:00
Credits
Alex Hordijk
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "splunk_enterprise",
"vendor": "splunk",
"versions": [
{
"lessThan": "9.1.6",
"status": "affected",
"version": "9.1",
"versionType": "custom"
},
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45733",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-15T16:16:11.035193Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-15T16:25:46.731Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Splunk Enterprise",
"vendor": "Splunk",
"versions": [
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
},
{
"lessThan": "9.1.6",
"status": "affected",
"version": "9.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Alex Hordijk"
}
],
"datePublic": "2024-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration."
}
],
"value": "In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-28T11:03:46.564Z",
"orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"shortName": "Splunk"
},
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2024-1003"
},
{
"url": "https://research.splunk.com/application/c97e0704-d9c6-454d-89ba-1510a987bf72/"
}
],
"source": {
"advisory": "SVD-2024-1003"
},
"title": "Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows"
}
},
"cveMetadata": {
"assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"assignerShortName": "Splunk",
"cveId": "CVE-2024-45733",
"datePublished": "2024-10-14T17:03:36.497Z",
"dateReserved": "2024-09-05T21:35:21.290Z",
"dateUpdated": "2025-02-28T11:03:46.564Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45734 (GCVE-0-2024-45734)
Vulnerability from cvelistv5 – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03
VLAI
EPSS
Title
Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard
Summary
In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-284 - The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Splunk | Splunk Enterprise |
Affected:
9.2 , < 9.2.3
(custom)
Affected: 9.1 , < 9.1.6 (custom) |
|
| splunk | splunk_enterprise |
Affected:
9.2 , < 9.2.3
(custom)
Affected: 9.1 , < 9.1.6 (custom) cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:* |
Date Public
2024-10-14 00:00
Credits
Anton (therceman)
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "splunk_enterprise",
"vendor": "splunk",
"versions": [
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
},
{
"lessThan": "9.1.6",
"status": "affected",
"version": "9.1",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45734",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-15T17:35:39.991677Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-15T17:36:41.279Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Splunk Enterprise",
"vendor": "Splunk",
"versions": [
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
},
{
"lessThan": "9.1.6",
"status": "affected",
"version": "9.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Anton (therceman)"
}
],
"datePublic": "2024-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard."
}
],
"value": "In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-28T11:03:43.384Z",
"orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"shortName": "Splunk"
},
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2024-1004"
},
{
"url": "https://research.splunk.com/application/7464e2dc-98a5-4af9-87a1-fa6d5a256fa6/"
}
],
"source": {
"advisory": "SVD-2024-1004"
},
"title": "Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard"
}
},
"cveMetadata": {
"assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"assignerShortName": "Splunk",
"cveId": "CVE-2024-45734",
"datePublished": "2024-10-14T17:03:30.412Z",
"dateReserved": "2024-09-05T21:35:21.290Z",
"dateUpdated": "2025-02-28T11:03:43.384Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45735 (GCVE-0-2024-45735)
Vulnerability from cvelistv5 – Published: 2024-10-14 16:45 – Updated: 2025-02-28 11:03
VLAI
EPSS
Title
Improper Access Control for low-privileged user in Splunk Secure Gateway App
Summary
In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the "admin" or "power" Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-284 - The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Splunk | Splunk Enterprise |
Affected:
9.2 , < 9.2.3
(custom)
Affected: 9.1 , < 9.1.6 (custom) |
|
| Splunk | Splunk Secure Gateway |
Affected:
3.6 , < 3.6.17
(custom)
Affected: 3.4 , < 3.4.259 (custom) |
|
| splunk | splunk_enterprise |
Affected:
9.2 , < 9.2.3
(custom)
Affected: 9.1 , < 9.1.6 (custom) cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:* |
|
| splunk | splunk_secure_gateway |
Affected:
3.6 , < 3.6.17
(custom)
Affected: 3.4 , < 3.4.259 (custom) cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:* |
Date Public
2024-10-14 00:00
Credits
Gabriel Nitu, Splunk
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "splunk_enterprise",
"vendor": "splunk",
"versions": [
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
},
{
"lessThan": "9.1.6",
"status": "affected",
"version": "9.1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "splunk_secure_gateway",
"vendor": "splunk",
"versions": [
{
"lessThan": "3.6.17",
"status": "affected",
"version": "3.6",
"versionType": "custom"
},
{
"lessThan": "3.4.259",
"status": "affected",
"version": "3.4",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45735",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T19:22:41.212370Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-08T22:27:41.914Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Splunk Enterprise",
"vendor": "Splunk",
"versions": [
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
},
{
"lessThan": "9.1.6",
"status": "affected",
"version": "9.1",
"versionType": "custom"
}
]
},
{
"product": "Splunk Secure Gateway",
"vendor": "Splunk",
"versions": [
{
"lessThan": "3.6.17",
"status": "affected",
"version": "3.6",
"versionType": "custom"
},
{
"lessThan": "3.4.259",
"status": "affected",
"version": "3.4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Gabriel Nitu, Splunk"
}
],
"datePublic": "2024-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App."
}
],
"value": "In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-28T11:03:52.049Z",
"orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"shortName": "Splunk"
},
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2024-1005"
},
{
"url": "https://research.splunk.com/application/0a3d6035-7bef-4dfa-b01e-84349edac3b4/"
}
],
"source": {
"advisory": "SVD-2024-1005"
},
"title": "Improper Access Control for low-privileged user in Splunk Secure Gateway App"
}
},
"cveMetadata": {
"assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"assignerShortName": "Splunk",
"cveId": "CVE-2024-45735",
"datePublished": "2024-10-14T16:45:54.667Z",
"dateReserved": "2024-09-05T21:35:21.290Z",
"dateUpdated": "2025-02-28T11:03:52.049Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45736 (GCVE-0-2024-45736)
Vulnerability from cvelistv5 – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03
VLAI
EPSS
Title
Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon
Summary
In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query with an improperly formatted "INGEST_EVAL" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd).
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-400 - The software does not properly control the allocation and maintenance of a limited resource thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Splunk | Splunk Enterprise |
Affected:
9.3 , < 9.3.1
(custom)
Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) |
|
| Splunk | Splunk Cloud Platform |
Affected:
9.2.2403 , < 9.2.2403.107
(custom)
Affected: 9.1.2312 , < 9.1.2312.204 (custom) Affected: 9.1.2312 , < 9.1.2312.111 (custom) |
|
| splunk | splunk_enterprise |
Affected:
9.3 , < 9.3.1
(custom)
Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:* |
|
| splunk | splunk_cloud_platform |
Affected:
9.2.2403 , < 9.2.2403.107
(custom)
Affected: 9.1.2312 , < 9.1.2312.204 (custom) Affected: 9.1.2312 , < 9.1.2312.111 (custom) cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:* |
Date Public
2024-10-14 00:00
Credits
Danylo Dmytriiev (DDV_UA)
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "splunk_enterprise",
"vendor": "splunk",
"versions": [
{
"lessThan": "9.3.1",
"status": "affected",
"version": "9.3",
"versionType": "custom"
},
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
},
{
"lessThan": "9.1.6",
"status": "affected",
"version": "9.1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "splunk_cloud_platform",
"vendor": "splunk",
"versions": [
{
"lessThan": "9.2.2403.107",
"status": "affected",
"version": "9.2.2403",
"versionType": "custom"
},
{
"lessThan": "9.1.2312.204",
"status": "affected",
"version": "9.1.2312",
"versionType": "custom"
},
{
"lessThan": "9.1.2312.111",
"status": "affected",
"version": "9.1.2312",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45736",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-15T16:36:03.459233Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-15T16:40:23.384Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Splunk Enterprise",
"vendor": "Splunk",
"versions": [
{
"lessThan": "9.3.1",
"status": "affected",
"version": "9.3",
"versionType": "custom"
},
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
},
{
"lessThan": "9.1.6",
"status": "affected",
"version": "9.1",
"versionType": "custom"
}
]
},
{
"product": "Splunk Cloud Platform",
"vendor": "Splunk",
"versions": [
{
"lessThan": "9.2.2403.107",
"status": "affected",
"version": "9.2.2403",
"versionType": "custom"
},
{
"lessThan": "9.1.2312.204",
"status": "affected",
"version": "9.1.2312",
"versionType": "custom"
},
{
"lessThan": "9.1.2312.111",
"status": "affected",
"version": "9.1.2312",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Danylo\u00a0Dmytriiev (DDV_UA)"
}
],
"datePublic": "2024-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could craft a search query with an improperly formatted \"INGEST_EVAL\" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd)."
}
],
"value": "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could craft a search query with an improperly formatted \"INGEST_EVAL\" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "The software does not properly control the allocation and maintenance of a limited resource thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-28T11:03:54.861Z",
"orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"shortName": "Splunk"
},
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2024-1006"
},
{
"url": "https://research.splunk.com/application/08978eca-caff-44c1-84dc-53f17def4e14/"
}
],
"source": {
"advisory": "SVD-2024-1006"
},
"title": "Improperly Formatted \u2018INGEST_EVAL\u2019 Parameter Crashes Splunk Daemon"
}
},
"cveMetadata": {
"assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"assignerShortName": "Splunk",
"cveId": "CVE-2024-45736",
"datePublished": "2024-10-14T17:03:34.828Z",
"dateReserved": "2024-09-05T21:35:21.290Z",
"dateUpdated": "2025-02-28T11:03:54.861Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45737 (GCVE-0-2024-45737)
Vulnerability from cvelistv5 – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03
VLAI
EPSS
Title
Maintenance mode state change of App Key Value Store (KVStore) through Cross-Site Request Forgery (CSRF)
Summary
In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF).
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-352 - The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Splunk | Splunk Enterprise |
Affected:
9.3 , < 9.3.1
(custom)
Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) |
|
| Splunk | Splunk Cloud Platform |
Affected:
9.2.2403 , < 9.2.2403.108
(custom)
Affected: 9.1.2312 , < 9.1.2312.204 (custom) |
Date Public
2024-10-14 00:00
Credits
Anton (therceman)
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45737",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-15T15:44:26.102067Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-15T15:44:34.572Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Splunk Enterprise",
"vendor": "Splunk",
"versions": [
{
"lessThan": "9.3.1",
"status": "affected",
"version": "9.3",
"versionType": "custom"
},
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
},
{
"lessThan": "9.1.6",
"status": "affected",
"version": "9.1",
"versionType": "custom"
}
]
},
{
"product": "Splunk Cloud Platform",
"vendor": "Splunk",
"versions": [
{
"lessThan": "9.2.2403.108",
"status": "affected",
"version": "9.2.2403",
"versionType": "custom"
},
{
"lessThan": "9.1.2312.204",
"status": "affected",
"version": "9.1.2312",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Anton (therceman)"
}
],
"datePublic": "2024-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could change the maintenance mode state of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF)."
}
],
"value": "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could change the maintenance mode state of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-28T11:03:53.256Z",
"orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"shortName": "Splunk"
},
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2024-1007"
},
{
"url": "https://research.splunk.com/application/34bac267-a89b-4bd7-a072-a48eef1f15b8/"
}
],
"source": {
"advisory": "SVD-2024-1007"
},
"title": "Maintenance mode state change of App Key Value Store (KVStore) through Cross-Site Request Forgery (CSRF)"
}
},
"cveMetadata": {
"assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"assignerShortName": "Splunk",
"cveId": "CVE-2024-45737",
"datePublished": "2024-10-14T17:03:37.328Z",
"dateReserved": "2024-09-05T21:35:21.290Z",
"dateUpdated": "2025-02-28T11:03:53.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45738 (GCVE-0-2024-45738)
Vulnerability from cvelistv5 – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03
VLAI
EPSS
Title
Sensitive information disclosure in REST_Calls logging channel
Summary
In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure could happen if you configure the Splunk Enterprise `REST_Calls` log channel at the DEBUG logging level.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Splunk | Splunk Enterprise |
Affected:
9.3 , < 9.3.1
(custom)
Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) |
Date Public
2024-10-14 00:00
Credits
Eric McGinnis, Splunk
Rod Soto, Splunk
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45738",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-14T19:23:47.032004Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-17T05:39:00.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Splunk Enterprise",
"vendor": "Splunk",
"versions": [
{
"lessThan": "9.3.1",
"status": "affected",
"version": "9.3",
"versionType": "custom"
},
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
},
{
"lessThan": "9.1.6",
"status": "affected",
"version": "9.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Eric McGinnis, Splunk"
},
{
"lang": "en",
"value": "Rod Soto, Splunk"
}
],
"datePublic": "2024-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure could happen if you configure the Splunk Enterprise `REST_Calls` log channel at the DEBUG logging level."
}
],
"value": "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure could happen if you configure the Splunk Enterprise `REST_Calls` log channel at the DEBUG logging level."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-28T11:03:47.990Z",
"orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"shortName": "Splunk"
},
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2024-1008"
},
{
"url": "https://research.splunk.com/application/93dc7182-c5da-4085-82ec-401abf33d623/"
}
],
"source": {
"advisory": "SVD-2024-1008"
},
"title": "Sensitive information disclosure in REST_Calls logging channel"
}
},
"cveMetadata": {
"assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"assignerShortName": "Splunk",
"cveId": "CVE-2024-45738",
"datePublished": "2024-10-14T17:03:38.142Z",
"dateReserved": "2024-09-05T21:35:21.290Z",
"dateUpdated": "2025-02-28T11:03:47.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45739 (GCVE-0-2024-45739)
Vulnerability from cvelistv5 – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03
VLAI
EPSS
Title
Sensitive information disclosure in AdminManager logging channel
Summary
In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users. This exposure could happen when you configure the Splunk Enterprise AdminManager log channel at the DEBUG logging level.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Splunk | Splunk Enterprise |
Affected:
9.3 , < 9.3.1
(custom)
Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) |
Date Public
2024-10-14 00:00
Credits
Eric McGinnis, Splunk
Rod Soto, Splunk
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45739",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-14T19:19:09.856336Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-17T05:38:59.932Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Splunk Enterprise",
"vendor": "Splunk",
"versions": [
{
"lessThan": "9.3.1",
"status": "affected",
"version": "9.3",
"versionType": "custom"
},
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
},
{
"lessThan": "9.1.6",
"status": "affected",
"version": "9.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Eric McGinnis, Splunk"
},
{
"lang": "en",
"value": "Rod Soto, Splunk"
}
],
"datePublic": "2024-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users. This exposure could happen when you configure the Splunk Enterprise AdminManager log channel at the DEBUG logging level."
}
],
"value": "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users. This exposure could happen when you configure the Splunk Enterprise AdminManager log channel at the DEBUG logging level."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-28T11:03:52.768Z",
"orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"shortName": "Splunk"
},
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2024-1009"
},
{
"url": "https://research.splunk.com/application/93dc7182-c5da-4085-82ec-401abf33d623/"
}
],
"source": {
"advisory": "SVD-2024-1009"
},
"title": "Sensitive information disclosure in AdminManager logging channel"
}
},
"cveMetadata": {
"assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"assignerShortName": "Splunk",
"cveId": "CVE-2024-45739",
"datePublished": "2024-10-14T17:03:38.949Z",
"dateReserved": "2024-09-05T21:35:21.291Z",
"dateUpdated": "2025-02-28T11:03:52.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45740 (GCVE-0-2024-45740)
Vulnerability from cvelistv5 – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03
VLAI
EPSS
Title
Persistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk Enterprise
Summary
In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through Scheduled Views that could result in execution of unauthorized JavaScript code in the browser of a user.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Splunk | Splunk Enterprise |
Affected:
9.2 , < 9.2.3
(custom)
Affected: 9.1 , < 9.1.6 (custom) |
|
| Splunk | Splunk Cloud Platform |
Affected:
9.2.2403 , < 9.2.2403.100
(custom)
|
Date Public
2024-10-14 00:00
Credits
Danylo Dmytriiev (DDV_UA)
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45740",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-15T17:37:44.276401Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-15T17:37:53.294Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Splunk Enterprise",
"vendor": "Splunk",
"versions": [
{
"lessThan": "9.2.3",
"status": "affected",
"version": "9.2",
"versionType": "custom"
},
{
"lessThan": "9.1.6",
"status": "affected",
"version": "9.1",
"versionType": "custom"
}
]
},
{
"product": "Splunk Cloud Platform",
"vendor": "Splunk",
"versions": [
{
"lessThan": "9.2.2403.100",
"status": "affected",
"version": "9.2.2403",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Danylo Dmytriiev (DDV_UA)"
}
],
"datePublic": "2024-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could craft a malicious payload through Scheduled Views that could result in execution of unauthorized JavaScript code in the browser of a user."
}
],
"value": "In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could craft a malicious payload through Scheduled Views that could result in execution of unauthorized JavaScript code in the browser of a user."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-28T11:03:58.462Z",
"orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"shortName": "Splunk"
},
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2024-1010"
},
{
"url": "https://research.splunk.com/application/d4f55f7c-6518-4122-a197-951fe0f21b25/"
}
],
"source": {
"advisory": "SVD-2024-1010"
},
"title": "Persistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk Enterprise"
}
},
"cveMetadata": {
"assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
"assignerShortName": "Splunk",
"cveId": "CVE-2024-45740",
"datePublished": "2024-10-14T17:03:29.360Z",
"dateReserved": "2024-09-05T21:35:21.291Z",
"dateUpdated": "2025-02-28T11:03:58.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…