Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2024-45741 (GCVE-0-2024-45741)

Vulnerability from nvd – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:04

Title

Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise

Summary

In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a malicious payload through a custom configuration file that the "api.uri" parameter from the "/manager/search/apps/local" endpoint in Splunk Web calls. This could result in execution of unauthorized JavaScript code in the browser of a user.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 17:29 UTC

CWE

CWE-79 - The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigner

Splunk

References

2 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-1011
https://research.splunk.com/application/d7b5aa71-…

Impacted products

4 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom)
Splunk	Splunk Cloud Platform	Affected: 9.2.2403 , < 9.2.2403.108 (custom) Affected: 9.1.2312 , < 9.1.2312.205 (custom)
splunk	splunk_enterprise	Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::
splunk	splunk_cloud_platform	Affected: 9.2.2403 , < 9.2.2403.108 (custom) Affected: 9.1.2312 , < 9.1.2312.205 (custom) cpe:2.3:a:splunk:splunk_cloud_platform::::::::

Date Public

2024-10-14 00:00

Credits

Danylo Dmytriiev (DDV_UA)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.3",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.6",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_cloud_platform",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.2403.108",
                "status": "affected",
                "version": "9.2.2403",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.2312.205",
                "status": "affected",
                "version": "9.1.2312",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45741",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T17:29:56.360207Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T17:31:19.677Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.3",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.6",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud Platform",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.2403.108",
              "status": "affected",
              "version": "9.2.2403",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.2312.205",
              "status": "affected",
              "version": "9.1.2312",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Danylo Dmytriiev (DDV_UA)"
        }
      ],
      "datePublic": "2024-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could create a malicious payload through a custom configuration file that the \"api.uri\" parameter from the \"/manager/search/apps/local\" endpoint in Splunk Web calls. This could result in execution of unauthorized JavaScript code in the browser of a user."
            }
          ],
          "value": "In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could create a malicious payload through a custom configuration file that the \"api.uri\" parameter from the \"/manager/search/apps/local\" endpoint in Splunk Web calls. This could result in execution of unauthorized JavaScript code in the browser of a user."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:04:00.392Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-1011"
        },
        {
          "url": "https://research.splunk.com/application/d7b5aa71-157f-4359-9c34-e35752b1d0a2/"
        }
      ],
      "source": {
        "advisory": "SVD-2024-1011"
      },
      "title": "Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-45741",
    "datePublished": "2024-10-14T17:03:33.986Z",
    "dateReserved": "2024-09-05T21:35:21.291Z",
    "dateUpdated": "2025-02-28T11:04:00.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45736 (GCVE-0-2024-45736)

Vulnerability from nvd – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03

Title

Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon

Summary

In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query with an improperly formatted "INGEST_EVAL" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd).

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 16:36 UTC

CWE

CWE-400 - The software does not properly control the allocation and maintenance of a limited resource thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Assigner

Splunk

References

2 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-1006
https://research.splunk.com/application/08978eca-…

Impacted products

4 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.3 , < 9.3.1 (custom) Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom)
Splunk	Splunk Cloud Platform	Affected: 9.2.2403 , < 9.2.2403.107 (custom) Affected: 9.1.2312 , < 9.1.2312.204 (custom) Affected: 9.1.2312 , < 9.1.2312.111 (custom)
splunk	splunk_enterprise	Affected: 9.3 , < 9.3.1 (custom) Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::
splunk	splunk_cloud_platform	Affected: 9.2.2403 , < 9.2.2403.107 (custom) Affected: 9.1.2312 , < 9.1.2312.204 (custom) Affected: 9.1.2312 , < 9.1.2312.111 (custom) cpe:2.3:a:splunk:splunk_cloud_platform::::::::

Date Public

2024-10-14 00:00

Credits

Danylo Dmytriiev (DDV_UA)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.3.1",
                "status": "affected",
                "version": "9.3",
                "versionType": "custom"
              },
              {
                "lessThan": "9.2.3",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.6",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_cloud_platform",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.2403.107",
                "status": "affected",
                "version": "9.2.2403",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.2312.204",
                "status": "affected",
                "version": "9.1.2312",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.2312.111",
                "status": "affected",
                "version": "9.1.2312",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45736",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T16:36:03.459233Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T16:40:23.384Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.3.1",
              "status": "affected",
              "version": "9.3",
              "versionType": "custom"
            },
            {
              "lessThan": "9.2.3",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.6",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud Platform",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.2403.107",
              "status": "affected",
              "version": "9.2.2403",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.2312.204",
              "status": "affected",
              "version": "9.1.2312",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.2312.111",
              "status": "affected",
              "version": "9.1.2312",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Danylo\u00a0Dmytriiev (DDV_UA)"
        }
      ],
      "datePublic": "2024-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could craft a search query with an improperly formatted  \"INGEST_EVAL\" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd)."
            }
          ],
          "value": "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could craft a search query with an improperly formatted  \"INGEST_EVAL\" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "The software does not properly control the allocation and maintenance of a limited resource thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:54.861Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-1006"
        },
        {
          "url": "https://research.splunk.com/application/08978eca-caff-44c1-84dc-53f17def4e14/"
        }
      ],
      "source": {
        "advisory": "SVD-2024-1006"
      },
      "title": "Improperly Formatted \u2018INGEST_EVAL\u2019 Parameter Crashes Splunk Daemon"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-45736",
    "datePublished": "2024-10-14T17:03:34.828Z",
    "dateReserved": "2024-09-05T21:35:21.290Z",
    "dateUpdated": "2025-02-28T11:03:54.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45735 (GCVE-0-2024-45735)

Vulnerability from nvd – Published: 2024-10-14 16:45 – Updated: 2025-02-28 11:03

Title

Improper Access Control for low-privileged user in Splunk Secure Gateway App

Summary

In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the "admin" or "power" Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-08 19:22 UTC

CWE

CWE-284 - The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigner

Splunk

References

2 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-1005
https://research.splunk.com/application/0a3d6035-…

Impacted products

4 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom)
Splunk	Splunk Secure Gateway	Affected: 3.6 , < 3.6.17 (custom) Affected: 3.4 , < 3.4.259 (custom)
splunk	splunk_enterprise	Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::
splunk	splunk_secure_gateway	Affected: 3.6 , < 3.6.17 (custom) Affected: 3.4 , < 3.4.259 (custom) cpe:2.3:a:splunk:splunk_secure_gateway::::::::

Date Public

2024-10-14 00:00

Credits

Gabriel Nitu, Splunk

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.3",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.6",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_secure_gateway",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "3.6.17",
                "status": "affected",
                "version": "3.6",
                "versionType": "custom"
              },
              {
                "lessThan": "3.4.259",
                "status": "affected",
                "version": "3.4",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45735",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-08T19:22:41.212370Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-08T22:27:41.914Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.3",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.6",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Secure Gateway",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "3.6.17",
              "status": "affected",
              "version": "3.6",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.259",
              "status": "affected",
              "version": "3.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Gabriel Nitu, Splunk"
        }
      ],
      "datePublic": "2024-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App."
            }
          ],
          "value": "In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:52.049Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-1005"
        },
        {
          "url": "https://research.splunk.com/application/0a3d6035-7bef-4dfa-b01e-84349edac3b4/"
        }
      ],
      "source": {
        "advisory": "SVD-2024-1005"
      },
      "title": "Improper Access Control for low-privileged user in Splunk Secure Gateway App"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-45735",
    "datePublished": "2024-10-14T16:45:54.667Z",
    "dateReserved": "2024-09-05T21:35:21.290Z",
    "dateUpdated": "2025-02-28T11:03:52.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45734 (GCVE-0-2024-45734)

Vulnerability from nvd – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03

Title

Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard

Summary

In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 17:35 UTC

CWE

CWE-284 - The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigner

Splunk

References

2 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-1004
https://research.splunk.com/application/7464e2dc-…

Impacted products

2 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom)
splunk	splunk_enterprise	Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::

Date Public

2024-10-14 00:00

Credits

Anton (therceman)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.3",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.6",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45734",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T17:35:39.991677Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T17:36:41.279Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.3",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.6",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Anton (therceman)"
        }
      ],
      "datePublic": "2024-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the  machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard."
            }
          ],
          "value": "In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the  machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:43.384Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-1004"
        },
        {
          "url": "https://research.splunk.com/application/7464e2dc-98a5-4af9-87a1-fa6d5a256fa6/"
        }
      ],
      "source": {
        "advisory": "SVD-2024-1004"
      },
      "title": "Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-45734",
    "datePublished": "2024-10-14T17:03:30.412Z",
    "dateReserved": "2024-09-05T21:35:21.290Z",
    "dateUpdated": "2025-02-28T11:03:43.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45733 (GCVE-0-2024-45733)

Vulnerability from nvd – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03

Title

Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows

Summary

In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 16:16 UTC

CWE

CWE-502 - The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Assigner

Splunk

References

2 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-1003
https://research.splunk.com/application/c97e0704-…

Impacted products

2 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom)
splunk	splunk_enterprise	Affected: 9.1 , < 9.1.6 (custom) Affected: 9.2 , < 9.2.3 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::

Date Public

2024-10-14 00:00

Credits

Alex Hordijk

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.1.6",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              },
              {
                "lessThan": "9.2.3",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45733",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T16:16:11.035193Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T16:25:46.731Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.3",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.6",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Alex Hordijk"
        }
      ],
      "datePublic": "2024-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration."
            }
          ],
          "value": "In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:46.564Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-1003"
        },
        {
          "url": "https://research.splunk.com/application/c97e0704-d9c6-454d-89ba-1510a987bf72/"
        }
      ],
      "source": {
        "advisory": "SVD-2024-1003"
      },
      "title": "Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-45733",
    "datePublished": "2024-10-14T17:03:36.497Z",
    "dateReserved": "2024-09-05T21:35:21.290Z",
    "dateUpdated": "2025-02-28T11:03:46.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45732 (GCVE-0-2024-45732)

Vulnerability from nvd – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03

Title

Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app

Summary

In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 16:30 UTC

CWE

CWE-862 - The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

Assigner

Splunk

References

2 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-1002
https://research.splunk.com/application/f765c3fe-…

Impacted products

4 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.3 , < 9.3.1 (custom) Affected: 9.2 , < 9.2.3 (custom)
Splunk	Splunk Cloud Platform	Affected: 9.2.2403 , < 9.2.2403.103 (custom) Affected: 9.1.2312 , < 9.1.2312.110, 9.1.2312.200 (custom) Affected: 9.1.2308 , < 9.1.2308.208 (custom)
splunk	splunk_enterprise	Affected: 9.3 , < 9.3.1 (custom) Affected: 9.2 , < 9.2.3 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::
splunk	splunk_cloud_platform	Affected: 9.2.2403 , < 9.2.2403.103 (custom) Affected: 9.1.2312 , < 9.1.2312.200 (custom) Unaffected: 9.1.2312.110 Affected: 9.1.2308 , < 9.1.2308.208 (custom) cpe:2.3:a:splunk:splunk_cloud_platform::::::::

Date Public

2024-10-14 00:00

Credits

Anton (therceman)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.3.1",
                "status": "affected",
                "version": "9.3",
                "versionType": "custom"
              },
              {
                "lessThan": "9.2.3",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_cloud_platform",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.2403.103",
                "status": "affected",
                "version": "9.2.2403",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.2312.200",
                "status": "affected",
                "version": "9.1.2312",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "9.1.2312.110"
              },
              {
                "lessThan": "9.1.2308.208",
                "status": "affected",
                "version": "9.1.2308",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45732",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T16:30:27.363227Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T16:34:10.045Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.3.1",
              "status": "affected",
              "version": "9.3",
              "versionType": "custom"
            },
            {
              "lessThan": "9.2.3",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud Platform",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.2403.103",
              "status": "affected",
              "version": "9.2.2403",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.2312.110, 9.1.2312.200",
              "status": "affected",
              "version": "9.1.2312",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.2308.208",
              "status": "affected",
              "version": "9.1.2308",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Anton (therceman)"
        }
      ],
      "datePublic": "2024-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could run a search as the \"nobody\" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data."
            }
          ],
          "value": "In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could run a search as the \"nobody\" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "The software does not perform an authorization check when an actor attempts to access a resource or perform an action.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:50.807Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-1002"
        },
        {
          "url": "https://research.splunk.com/application/f765c3fe-c3b6-4afe-a932-11dd4f3a024f/"
        }
      ],
      "source": {
        "advisory": "SVD-2024-1002"
      },
      "title": "Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-45732",
    "datePublished": "2024-10-14T17:03:35.668Z",
    "dateReserved": "2024-09-05T21:35:21.290Z",
    "dateUpdated": "2025-02-28T11:03:50.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45731 (GCVE-0-2024-45731)

Vulnerability from nvd – Published: 2024-10-14 16:46 – Updated: 2025-02-28 11:03

Title

Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk

Summary

In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 17:38 UTC

CWE

CWE-23 - The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.

Assigner

Splunk

References

2 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-1001
https://research.splunk.com/application/c97e0704-…

Impacted products

2 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.3 , < 9.3.1 (custom) Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom)
splunk	splunk_enterprise	Affected: 9.3 , < 9.3.1 (custom) Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::

Date Public

2024-10-14 00:00

Credits

Alex Hordijk (hordalex)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.3.1",
                "status": "affected",
                "version": "9.3",
                "versionType": "custom"
              },
              {
                "lessThan": "9.2.3",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.6",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45731",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T17:38:45.988147Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T17:39:52.042Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.3.1",
              "status": "affected",
              "version": "9.3",
              "versionType": "custom"
            },
            {
              "lessThan": "9.2.3",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.6",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Alex Hordijk (hordalex)"
        }
      ],
      "datePublic": "2024-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive."
            }
          ],
          "value": "In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:47.249Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-1001"
        },
        {
          "url": "https://research.splunk.com/application/c97e0704-d9c6-454d-89ba-1510a987bf72/"
        }
      ],
      "source": {
        "advisory": "SVD-2024-1001"
      },
      "title": "Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-45731",
    "datePublished": "2024-10-14T16:46:01.751Z",
    "dateReserved": "2024-09-05T21:35:21.290Z",
    "dateUpdated": "2025-02-28T11:03:47.249Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-36996 (GCVE-0-2024-36996)

Vulnerability from nvd – Published: 2024-07-01 16:30 – Updated: 2025-02-28 11:03

Title

Information Disclosure of user names

Summary

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive from the instance when they attempt to log in. This disclosure could then lead to additional brute-force password-guessing attacks. This vulnerability would require that the Splunk platform instance uses the Security Assertion Markup Language (SAML) authentication scheme.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-01 19:26 UTC

CWE

CWE-204 - The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Assigner

Splunk

References

1 reference

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-0716

Impacted products

4 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.2 , < 9.2.2 (custom) Affected: 9.1 , < 9.1.5 (custom) Affected: 9.0 , < 9.0.10 (custom)
Splunk	Splunk Cloud Platform	Affected: 9.1.2312 , < 9.1.2312.109 (custom)
splunk	splunk_enterprise	Affected: 9.2 , < 9.2.2 (custom) Affected: 9.1 , < 9.1.5 (custom) Affected: 9.0 , < 9.0.10 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::
splunk	splunk_cloud_platform	Affected: 9.1.2312 , < 9.1.2312.109 (custom) cpe:2.3:a:splunk:splunk_cloud_platform::::::::

Date Public

2024-07-01 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.2",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.5",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              },
              {
                "lessThan": "9.0.10",
                "status": "affected",
                "version": "9.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_cloud_platform",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.1.2312.109",
                "status": "affected",
                "version": "9.1.2312",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36996",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-01T19:26:51.643823Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-03T21:00:22.102Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.582Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://advisory.splunk.com/advisories/SVD-2024-0716"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.2",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.5",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            },
            {
              "lessThan": "9.0.10",
              "status": "affected",
              "version": "9.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud Platform",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.1.2312.109",
              "status": "affected",
              "version": "9.1.2312",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-07-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive from the instance when they attempt to log in. This disclosure could then lead to additional brute-force password-guessing attacks. This vulnerability would require that the Splunk platform instance uses the Security Assertion Markup Language (SAML) authentication scheme."
            }
          ],
          "value": "In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive from the instance when they attempt to log in. This disclosure could then lead to additional brute-force password-guessing attacks. This vulnerability would require that the Splunk platform instance uses the Security Assertion Markup Language (SAML) authentication scheme."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-204",
              "description": "The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:41.084Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-0716"
        }
      ],
      "source": {
        "advisory": "SVD-2024-0716"
      },
      "title": "Information Disclosure of user names"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-36996",
    "datePublished": "2024-07-01T16:30:41.186Z",
    "dateReserved": "2024-05-30T16:36:21.002Z",
    "dateUpdated": "2025-02-28T11:03:41.084Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-36982 (GCVE-0-2024-36982)

Vulnerability from nvd – Published: 2024-07-01 16:31 – Updated: 2025-02-28 11:03

Title

Denial of Service through null pointer reference in “cluster/config” REST endpoint

Summary

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash of the Splunk daemon.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-02 19:30 UTC

CWE

CWE-476 - A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Assigner

Splunk

References

1 reference

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-0702

Impacted products

4 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.2 , < 9.2.2 (custom) Affected: 9.1 , < 9.1.5 (custom) Affected: 9.0 , < 9.0.10 (custom)
Splunk	Splunk Cloud Platform	Affected: 9.1.2312 , < 9.1.2312.109 (custom) Affected: 9.1.2308 , < 9.1.2308.207 (custom)
splunk	splunk_enterprise	Affected: 9.2 , < 9.2.2 (custom) Affected: 9.1 , < 9.1.5 (custom) Affected: 9.0 , < 9.0.10 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::
splunk	splunk_cloud_platform	Affected: 9.1.2312 , < 9.1.2312.109 (custom) Affected: 9.1.2308 , < 9.1.2308.207 (custom) cpe:2.3:a:splunk:splunk_cloud_platform::::::::

Date Public

2024-07-01 00:00

Credits

d0nahu3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.2",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.5",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              },
              {
                "lessThan": "9.0.10",
                "status": "affected",
                "version": "9.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_cloud_platform",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.1.2312.109",
                "status": "affected",
                "version": "9.1.2312",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.2308.207",
                "status": "affected",
                "version": "9.1.2308",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36982",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-02T19:30:42.665566Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-02T19:47:20.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.531Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://advisory.splunk.com/advisories/SVD-2024-0702"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.2",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.5",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            },
            {
              "lessThan": "9.0.10",
              "status": "affected",
              "version": "9.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud Platform",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.1.2312.109",
              "status": "affected",
              "version": "9.1.2312",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.2308.207",
              "status": "affected",
              "version": "9.1.2308",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "d0nahu3"
        }
      ],
      "datePublic": "2024-07-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash of the Splunk daemon."
            }
          ],
          "value": "In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash of the Splunk daemon."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:48.458Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-0702"
        }
      ],
      "source": {
        "advisory": "SVD-2024-0702"
      },
      "title": "Denial of Service through null pointer reference in \u201ccluster/config\u201d REST endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-36982",
    "datePublished": "2024-07-01T16:31:04.078Z",
    "dateReserved": "2024-05-30T16:36:20.999Z",
    "dateUpdated": "2025-02-28T11:03:48.458Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-46214 (GCVE-0-2023-46214)

Vulnerability from nvd – Published: 2023-11-16 20:15 – Updated: 2025-12-16 18:23

Title

Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing

Summary

In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-10 13:55 UTC

CWE

CWE-91 - The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Assigner

Splunk

References

3 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2023-1104
https://research.splunk.com/application/a053e6a6-…
https://research.splunk.com/application/6cb7e011-…

Impacted products

3 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.0 , < 9.0.7 (custom) Affected: 9.1 , < 9.1.2 (custom)
Splunk	Splunk Cloud	Affected: - , < 9.1.2308 (custom)
splunk	splunk_enterprise	Affected: 9.1 , < 9.1.2 (custom) Affected: 9.0 , < 9.0.7 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::

Date Public

2023-11-16 00:00

Credits

Alex Hordijk

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:37:40.138Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://advisory.splunk.com/advisories/SVD-2023-1104"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.1.2",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              },
              {
                "lessThan": "9.0.7",
                "status": "affected",
                "version": "9.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.1.2",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              },
              {
                "lessThan": "9.0.7",
                "status": "affected",
                "version": "9.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-46214",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-10T13:55:55.284479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-16T18:23:23.962Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.0.7",
              "status": "affected",
              "version": "9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.2",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.1.2308",
              "status": "affected",
              "version": "-",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Alex Hordijk"
        }
      ],
      "datePublic": "2023-11-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance."
            }
          ],
          "value": "In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-91",
              "description": "The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:52.275Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2023-1104"
        },
        {
          "url": "https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/"
        },
        {
          "url": "https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/"
        }
      ],
      "source": {
        "advisory": "SVD-2023-1104"
      },
      "title": "Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2023-46214",
    "datePublished": "2023-11-16T20:15:25.838Z",
    "dateReserved": "2023-10-18T17:02:51.236Z",
    "dateUpdated": "2025-12-16T18:23:23.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-45733 (GCVE-0-2024-45733)

Vulnerability from cvelistv5 – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03

Title

Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows

Summary

In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 16:16 UTC

CWE

CWE-502 - The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Assigner

Splunk

References

2 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-1003
https://research.splunk.com/application/c97e0704-…

Impacted products

2 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom)
splunk	splunk_enterprise	Affected: 9.1 , < 9.1.6 (custom) Affected: 9.2 , < 9.2.3 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::

Date Public

2024-10-14 00:00

Credits

Alex Hordijk

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.1.6",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              },
              {
                "lessThan": "9.2.3",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45733",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T16:16:11.035193Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T16:25:46.731Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.3",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.6",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Alex Hordijk"
        }
      ],
      "datePublic": "2024-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration."
            }
          ],
          "value": "In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:46.564Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-1003"
        },
        {
          "url": "https://research.splunk.com/application/c97e0704-d9c6-454d-89ba-1510a987bf72/"
        }
      ],
      "source": {
        "advisory": "SVD-2024-1003"
      },
      "title": "Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-45733",
    "datePublished": "2024-10-14T17:03:36.497Z",
    "dateReserved": "2024-09-05T21:35:21.290Z",
    "dateUpdated": "2025-02-28T11:03:46.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45732 (GCVE-0-2024-45732)

Vulnerability from cvelistv5 – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03

Title

Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app

Summary

In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 16:30 UTC

CWE

CWE-862 - The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

Assigner

Splunk

References

2 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-1002
https://research.splunk.com/application/f765c3fe-…

Impacted products

4 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.3 , < 9.3.1 (custom) Affected: 9.2 , < 9.2.3 (custom)
Splunk	Splunk Cloud Platform	Affected: 9.2.2403 , < 9.2.2403.103 (custom) Affected: 9.1.2312 , < 9.1.2312.110, 9.1.2312.200 (custom) Affected: 9.1.2308 , < 9.1.2308.208 (custom)
splunk	splunk_enterprise	Affected: 9.3 , < 9.3.1 (custom) Affected: 9.2 , < 9.2.3 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::
splunk	splunk_cloud_platform	Affected: 9.2.2403 , < 9.2.2403.103 (custom) Affected: 9.1.2312 , < 9.1.2312.200 (custom) Unaffected: 9.1.2312.110 Affected: 9.1.2308 , < 9.1.2308.208 (custom) cpe:2.3:a:splunk:splunk_cloud_platform::::::::

Date Public

2024-10-14 00:00

Credits

Anton (therceman)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.3.1",
                "status": "affected",
                "version": "9.3",
                "versionType": "custom"
              },
              {
                "lessThan": "9.2.3",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_cloud_platform",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.2403.103",
                "status": "affected",
                "version": "9.2.2403",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.2312.200",
                "status": "affected",
                "version": "9.1.2312",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "9.1.2312.110"
              },
              {
                "lessThan": "9.1.2308.208",
                "status": "affected",
                "version": "9.1.2308",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45732",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T16:30:27.363227Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T16:34:10.045Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.3.1",
              "status": "affected",
              "version": "9.3",
              "versionType": "custom"
            },
            {
              "lessThan": "9.2.3",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud Platform",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.2403.103",
              "status": "affected",
              "version": "9.2.2403",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.2312.110, 9.1.2312.200",
              "status": "affected",
              "version": "9.1.2312",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.2308.208",
              "status": "affected",
              "version": "9.1.2308",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Anton (therceman)"
        }
      ],
      "datePublic": "2024-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could run a search as the \"nobody\" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data."
            }
          ],
          "value": "In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could run a search as the \"nobody\" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "The software does not perform an authorization check when an actor attempts to access a resource or perform an action.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:50.807Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-1002"
        },
        {
          "url": "https://research.splunk.com/application/f765c3fe-c3b6-4afe-a932-11dd4f3a024f/"
        }
      ],
      "source": {
        "advisory": "SVD-2024-1002"
      },
      "title": "Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-45732",
    "datePublished": "2024-10-14T17:03:35.668Z",
    "dateReserved": "2024-09-05T21:35:21.290Z",
    "dateUpdated": "2025-02-28T11:03:50.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45736 (GCVE-0-2024-45736)

Vulnerability from cvelistv5 – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03

Title

Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon

Summary

In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query with an improperly formatted "INGEST_EVAL" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd).

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 16:36 UTC

CWE

CWE-400 - The software does not properly control the allocation and maintenance of a limited resource thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Assigner

Splunk

References

2 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-1006
https://research.splunk.com/application/08978eca-…

Impacted products

4 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.3 , < 9.3.1 (custom) Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom)
Splunk	Splunk Cloud Platform	Affected: 9.2.2403 , < 9.2.2403.107 (custom) Affected: 9.1.2312 , < 9.1.2312.204 (custom) Affected: 9.1.2312 , < 9.1.2312.111 (custom)
splunk	splunk_enterprise	Affected: 9.3 , < 9.3.1 (custom) Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::
splunk	splunk_cloud_platform	Affected: 9.2.2403 , < 9.2.2403.107 (custom) Affected: 9.1.2312 , < 9.1.2312.204 (custom) Affected: 9.1.2312 , < 9.1.2312.111 (custom) cpe:2.3:a:splunk:splunk_cloud_platform::::::::

Date Public

2024-10-14 00:00

Credits

Danylo Dmytriiev (DDV_UA)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.3.1",
                "status": "affected",
                "version": "9.3",
                "versionType": "custom"
              },
              {
                "lessThan": "9.2.3",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.6",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_cloud_platform",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.2403.107",
                "status": "affected",
                "version": "9.2.2403",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.2312.204",
                "status": "affected",
                "version": "9.1.2312",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.2312.111",
                "status": "affected",
                "version": "9.1.2312",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45736",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T16:36:03.459233Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T16:40:23.384Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.3.1",
              "status": "affected",
              "version": "9.3",
              "versionType": "custom"
            },
            {
              "lessThan": "9.2.3",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.6",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud Platform",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.2403.107",
              "status": "affected",
              "version": "9.2.2403",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.2312.204",
              "status": "affected",
              "version": "9.1.2312",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.2312.111",
              "status": "affected",
              "version": "9.1.2312",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Danylo\u00a0Dmytriiev (DDV_UA)"
        }
      ],
      "datePublic": "2024-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could craft a search query with an improperly formatted  \"INGEST_EVAL\" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd)."
            }
          ],
          "value": "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could craft a search query with an improperly formatted  \"INGEST_EVAL\" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "The software does not properly control the allocation and maintenance of a limited resource thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:54.861Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-1006"
        },
        {
          "url": "https://research.splunk.com/application/08978eca-caff-44c1-84dc-53f17def4e14/"
        }
      ],
      "source": {
        "advisory": "SVD-2024-1006"
      },
      "title": "Improperly Formatted \u2018INGEST_EVAL\u2019 Parameter Crashes Splunk Daemon"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-45736",
    "datePublished": "2024-10-14T17:03:34.828Z",
    "dateReserved": "2024-09-05T21:35:21.290Z",
    "dateUpdated": "2025-02-28T11:03:54.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45741 (GCVE-0-2024-45741)

Vulnerability from cvelistv5 – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:04

Title

Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise

Summary

In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a malicious payload through a custom configuration file that the "api.uri" parameter from the "/manager/search/apps/local" endpoint in Splunk Web calls. This could result in execution of unauthorized JavaScript code in the browser of a user.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 17:29 UTC

CWE

CWE-79 - The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigner

Splunk

References

2 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-1011
https://research.splunk.com/application/d7b5aa71-…

Impacted products

4 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom)
Splunk	Splunk Cloud Platform	Affected: 9.2.2403 , < 9.2.2403.108 (custom) Affected: 9.1.2312 , < 9.1.2312.205 (custom)
splunk	splunk_enterprise	Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::
splunk	splunk_cloud_platform	Affected: 9.2.2403 , < 9.2.2403.108 (custom) Affected: 9.1.2312 , < 9.1.2312.205 (custom) cpe:2.3:a:splunk:splunk_cloud_platform::::::::

Date Public

2024-10-14 00:00

Credits

Danylo Dmytriiev (DDV_UA)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.3",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.6",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_cloud_platform",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.2403.108",
                "status": "affected",
                "version": "9.2.2403",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.2312.205",
                "status": "affected",
                "version": "9.1.2312",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45741",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T17:29:56.360207Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T17:31:19.677Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.3",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.6",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud Platform",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.2403.108",
              "status": "affected",
              "version": "9.2.2403",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.2312.205",
              "status": "affected",
              "version": "9.1.2312",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Danylo Dmytriiev (DDV_UA)"
        }
      ],
      "datePublic": "2024-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could create a malicious payload through a custom configuration file that the \"api.uri\" parameter from the \"/manager/search/apps/local\" endpoint in Splunk Web calls. This could result in execution of unauthorized JavaScript code in the browser of a user."
            }
          ],
          "value": "In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could create a malicious payload through a custom configuration file that the \"api.uri\" parameter from the \"/manager/search/apps/local\" endpoint in Splunk Web calls. This could result in execution of unauthorized JavaScript code in the browser of a user."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:04:00.392Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-1011"
        },
        {
          "url": "https://research.splunk.com/application/d7b5aa71-157f-4359-9c34-e35752b1d0a2/"
        }
      ],
      "source": {
        "advisory": "SVD-2024-1011"
      },
      "title": "Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-45741",
    "datePublished": "2024-10-14T17:03:33.986Z",
    "dateReserved": "2024-09-05T21:35:21.291Z",
    "dateUpdated": "2025-02-28T11:04:00.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45734 (GCVE-0-2024-45734)

Vulnerability from cvelistv5 – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03

Title

Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard

Summary

In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 17:35 UTC

CWE

CWE-284 - The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigner

Splunk

References

2 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-1004
https://research.splunk.com/application/7464e2dc-…

Impacted products

2 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom)
splunk	splunk_enterprise	Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::

Date Public

2024-10-14 00:00

Credits

Anton (therceman)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.3",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.6",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45734",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T17:35:39.991677Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T17:36:41.279Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.3",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.6",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Anton (therceman)"
        }
      ],
      "datePublic": "2024-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the  machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard."
            }
          ],
          "value": "In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the  machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:43.384Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-1004"
        },
        {
          "url": "https://research.splunk.com/application/7464e2dc-98a5-4af9-87a1-fa6d5a256fa6/"
        }
      ],
      "source": {
        "advisory": "SVD-2024-1004"
      },
      "title": "Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-45734",
    "datePublished": "2024-10-14T17:03:30.412Z",
    "dateReserved": "2024-09-05T21:35:21.290Z",
    "dateUpdated": "2025-02-28T11:03:43.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45731 (GCVE-0-2024-45731)

Vulnerability from cvelistv5 – Published: 2024-10-14 16:46 – Updated: 2025-02-28 11:03

Title

Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk

Summary

In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 17:38 UTC

CWE

CWE-23 - The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.

Assigner

Splunk

References

2 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-1001
https://research.splunk.com/application/c97e0704-…

Impacted products

2 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.3 , < 9.3.1 (custom) Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom)
splunk	splunk_enterprise	Affected: 9.3 , < 9.3.1 (custom) Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::

Date Public

2024-10-14 00:00

Credits

Alex Hordijk (hordalex)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.3.1",
                "status": "affected",
                "version": "9.3",
                "versionType": "custom"
              },
              {
                "lessThan": "9.2.3",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.6",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45731",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T17:38:45.988147Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T17:39:52.042Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.3.1",
              "status": "affected",
              "version": "9.3",
              "versionType": "custom"
            },
            {
              "lessThan": "9.2.3",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.6",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Alex Hordijk (hordalex)"
        }
      ],
      "datePublic": "2024-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive."
            }
          ],
          "value": "In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:47.249Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-1001"
        },
        {
          "url": "https://research.splunk.com/application/c97e0704-d9c6-454d-89ba-1510a987bf72/"
        }
      ],
      "source": {
        "advisory": "SVD-2024-1001"
      },
      "title": "Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-45731",
    "datePublished": "2024-10-14T16:46:01.751Z",
    "dateReserved": "2024-09-05T21:35:21.290Z",
    "dateUpdated": "2025-02-28T11:03:47.249Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45735 (GCVE-0-2024-45735)

Vulnerability from cvelistv5 – Published: 2024-10-14 16:45 – Updated: 2025-02-28 11:03

Title

Improper Access Control for low-privileged user in Splunk Secure Gateway App

Summary

In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the "admin" or "power" Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-08 19:22 UTC

CWE

CWE-284 - The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigner

Splunk

References

2 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-1005
https://research.splunk.com/application/0a3d6035-…

Impacted products

4 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom)
Splunk	Splunk Secure Gateway	Affected: 3.6 , < 3.6.17 (custom) Affected: 3.4 , < 3.4.259 (custom)
splunk	splunk_enterprise	Affected: 9.2 , < 9.2.3 (custom) Affected: 9.1 , < 9.1.6 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::
splunk	splunk_secure_gateway	Affected: 3.6 , < 3.6.17 (custom) Affected: 3.4 , < 3.4.259 (custom) cpe:2.3:a:splunk:splunk_secure_gateway::::::::

Date Public

2024-10-14 00:00

Credits

Gabriel Nitu, Splunk

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.3",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.6",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_secure_gateway",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "3.6.17",
                "status": "affected",
                "version": "3.6",
                "versionType": "custom"
              },
              {
                "lessThan": "3.4.259",
                "status": "affected",
                "version": "3.4",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45735",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-08T19:22:41.212370Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-08T22:27:41.914Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.3",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.6",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Secure Gateway",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "3.6.17",
              "status": "affected",
              "version": "3.6",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.259",
              "status": "affected",
              "version": "3.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Gabriel Nitu, Splunk"
        }
      ],
      "datePublic": "2024-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App."
            }
          ],
          "value": "In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:52.049Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-1005"
        },
        {
          "url": "https://research.splunk.com/application/0a3d6035-7bef-4dfa-b01e-84349edac3b4/"
        }
      ],
      "source": {
        "advisory": "SVD-2024-1005"
      },
      "title": "Improper Access Control for low-privileged user in Splunk Secure Gateway App"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-45735",
    "datePublished": "2024-10-14T16:45:54.667Z",
    "dateReserved": "2024-09-05T21:35:21.290Z",
    "dateUpdated": "2025-02-28T11:03:52.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-36982 (GCVE-0-2024-36982)

Vulnerability from cvelistv5 – Published: 2024-07-01 16:31 – Updated: 2025-02-28 11:03

Title

Denial of Service through null pointer reference in “cluster/config” REST endpoint

Summary

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash of the Splunk daemon.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-02 19:30 UTC

CWE

CWE-476 - A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Assigner

Splunk

References

1 reference

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-0702

Impacted products

4 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.2 , < 9.2.2 (custom) Affected: 9.1 , < 9.1.5 (custom) Affected: 9.0 , < 9.0.10 (custom)
Splunk	Splunk Cloud Platform	Affected: 9.1.2312 , < 9.1.2312.109 (custom) Affected: 9.1.2308 , < 9.1.2308.207 (custom)
splunk	splunk_enterprise	Affected: 9.2 , < 9.2.2 (custom) Affected: 9.1 , < 9.1.5 (custom) Affected: 9.0 , < 9.0.10 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::
splunk	splunk_cloud_platform	Affected: 9.1.2312 , < 9.1.2312.109 (custom) Affected: 9.1.2308 , < 9.1.2308.207 (custom) cpe:2.3:a:splunk:splunk_cloud_platform::::::::

Date Public

2024-07-01 00:00

Credits

d0nahu3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.2",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.5",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              },
              {
                "lessThan": "9.0.10",
                "status": "affected",
                "version": "9.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_cloud_platform",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.1.2312.109",
                "status": "affected",
                "version": "9.1.2312",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.2308.207",
                "status": "affected",
                "version": "9.1.2308",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36982",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-02T19:30:42.665566Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-02T19:47:20.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.531Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://advisory.splunk.com/advisories/SVD-2024-0702"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.2",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.5",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            },
            {
              "lessThan": "9.0.10",
              "status": "affected",
              "version": "9.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud Platform",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.1.2312.109",
              "status": "affected",
              "version": "9.1.2312",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.2308.207",
              "status": "affected",
              "version": "9.1.2308",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "d0nahu3"
        }
      ],
      "datePublic": "2024-07-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash of the Splunk daemon."
            }
          ],
          "value": "In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash of the Splunk daemon."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:48.458Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-0702"
        }
      ],
      "source": {
        "advisory": "SVD-2024-0702"
      },
      "title": "Denial of Service through null pointer reference in \u201ccluster/config\u201d REST endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-36982",
    "datePublished": "2024-07-01T16:31:04.078Z",
    "dateReserved": "2024-05-30T16:36:20.999Z",
    "dateUpdated": "2025-02-28T11:03:48.458Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-36996 (GCVE-0-2024-36996)

Vulnerability from cvelistv5 – Published: 2024-07-01 16:30 – Updated: 2025-02-28 11:03

Title

Information Disclosure of user names

Summary

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive from the instance when they attempt to log in. This disclosure could then lead to additional brute-force password-guessing attacks. This vulnerability would require that the Splunk platform instance uses the Security Assertion Markup Language (SAML) authentication scheme.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-01 19:26 UTC

CWE

CWE-204 - The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Assigner

Splunk

References

1 reference

URL	Tags
https://advisory.splunk.com/advisories/SVD-2024-0716

Impacted products

4 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.2 , < 9.2.2 (custom) Affected: 9.1 , < 9.1.5 (custom) Affected: 9.0 , < 9.0.10 (custom)
Splunk	Splunk Cloud Platform	Affected: 9.1.2312 , < 9.1.2312.109 (custom)
splunk	splunk_enterprise	Affected: 9.2 , < 9.2.2 (custom) Affected: 9.1 , < 9.1.5 (custom) Affected: 9.0 , < 9.0.10 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::
splunk	splunk_cloud_platform	Affected: 9.1.2312 , < 9.1.2312.109 (custom) cpe:2.3:a:splunk:splunk_cloud_platform::::::::

Date Public

2024-07-01 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.2",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.5",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              },
              {
                "lessThan": "9.0.10",
                "status": "affected",
                "version": "9.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_cloud_platform",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.1.2312.109",
                "status": "affected",
                "version": "9.1.2312",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36996",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-01T19:26:51.643823Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-03T21:00:22.102Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.582Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://advisory.splunk.com/advisories/SVD-2024-0716"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.2",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.5",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            },
            {
              "lessThan": "9.0.10",
              "status": "affected",
              "version": "9.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud Platform",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.1.2312.109",
              "status": "affected",
              "version": "9.1.2312",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-07-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive from the instance when they attempt to log in. This disclosure could then lead to additional brute-force password-guessing attacks. This vulnerability would require that the Splunk platform instance uses the Security Assertion Markup Language (SAML) authentication scheme."
            }
          ],
          "value": "In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive from the instance when they attempt to log in. This disclosure could then lead to additional brute-force password-guessing attacks. This vulnerability would require that the Splunk platform instance uses the Security Assertion Markup Language (SAML) authentication scheme."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-204",
              "description": "The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:41.084Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-0716"
        }
      ],
      "source": {
        "advisory": "SVD-2024-0716"
      },
      "title": "Information Disclosure of user names"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-36996",
    "datePublished": "2024-07-01T16:30:41.186Z",
    "dateReserved": "2024-05-30T16:36:21.002Z",
    "dateUpdated": "2025-02-28T11:03:41.084Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-46214 (GCVE-0-2023-46214)

Vulnerability from cvelistv5 – Published: 2023-11-16 20:15 – Updated: 2025-12-16 18:23

Title

Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing

Summary

In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-10 13:55 UTC

CWE

CWE-91 - The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Assigner

Splunk

References

3 references

URL	Tags
https://advisory.splunk.com/advisories/SVD-2023-1104
https://research.splunk.com/application/a053e6a6-…
https://research.splunk.com/application/6cb7e011-…

Impacted products

3 products

Vendor	Product	Version
Splunk	Splunk Enterprise	Affected: 9.0 , < 9.0.7 (custom) Affected: 9.1 , < 9.1.2 (custom)
Splunk	Splunk Cloud	Affected: - , < 9.1.2308 (custom)
splunk	splunk_enterprise	Affected: 9.1 , < 9.1.2 (custom) Affected: 9.0 , < 9.0.7 (custom) cpe:2.3:a:splunk:splunk_enterprise::::::::

Date Public

2023-11-16 00:00

Credits

Alex Hordijk

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:37:40.138Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://advisory.splunk.com/advisories/SVD-2023-1104"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.1.2",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              },
              {
                "lessThan": "9.0.7",
                "status": "affected",
                "version": "9.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.1.2",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              },
              {
                "lessThan": "9.0.7",
                "status": "affected",
                "version": "9.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-46214",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-10T13:55:55.284479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-16T18:23:23.962Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.0.7",
              "status": "affected",
              "version": "9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.2",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.1.2308",
              "status": "affected",
              "version": "-",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Alex Hordijk"
        }
      ],
      "datePublic": "2023-11-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance."
            }
          ],
          "value": "In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-91",
              "description": "The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:52.275Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2023-1104"
        },
        {
          "url": "https://research.splunk.com/application/a053e6a6-2146-483a-9798-2d43652f3299/"
        },
        {
          "url": "https://research.splunk.com/application/6cb7e011-55fb-48e3-a98d-164fa854e37e/"
        }
      ],
      "source": {
        "advisory": "SVD-2023-1104"
      },
      "title": "Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2023-46214",
    "datePublished": "2023-11-16T20:15:25.838Z",
    "dateReserved": "2023-10-18T17:02:51.236Z",
    "dateUpdated": "2025-12-16T18:23:23.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

20 vulnerabilities found for splunk_enterprise by splunk

CVE-2024-45741 (GCVE-0-2024-45741)

CVE-2024-45736 (GCVE-0-2024-45736)

CVE-2024-45735 (GCVE-0-2024-45735)

CVE-2024-45734 (GCVE-0-2024-45734)

CVE-2024-45733 (GCVE-0-2024-45733)

CVE-2024-45732 (GCVE-0-2024-45732)

CVE-2024-45731 (GCVE-0-2024-45731)

CVE-2024-36996 (GCVE-0-2024-36996)

CVE-2024-36982 (GCVE-0-2024-36982)

CVE-2023-46214 (GCVE-0-2023-46214)

CVE-2024-45733 (GCVE-0-2024-45733)

CVE-2024-45732 (GCVE-0-2024-45732)

CVE-2024-45736 (GCVE-0-2024-45736)

CVE-2024-45741 (GCVE-0-2024-45741)

CVE-2024-45734 (GCVE-0-2024-45734)

CVE-2024-45731 (GCVE-0-2024-45731)

CVE-2024-45735 (GCVE-0-2024-45735)

CVE-2024-36982 (GCVE-0-2024-36982)

CVE-2024-36996 (GCVE-0-2024-36996)

CVE-2023-46214 (GCVE-0-2023-46214)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

20 vulnerabilities found for splunk_enterprise by splunk

CVE-2024-45741 (GCVE-0-2024-45741)

CVE-2024-45736 (GCVE-0-2024-45736)

CVE-2024-45735 (GCVE-0-2024-45735)

CVE-2024-45734 (GCVE-0-2024-45734)

CVE-2024-45733 (GCVE-0-2024-45733)

CVE-2024-45732 (GCVE-0-2024-45732)

CVE-2024-45731 (GCVE-0-2024-45731)

CVE-2024-36996 (GCVE-0-2024-36996)

CVE-2024-36982 (GCVE-0-2024-36982)

CVE-2023-46214 (GCVE-0-2023-46214)

CVE-2024-45733 (GCVE-0-2024-45733)

CVE-2024-45732 (GCVE-0-2024-45732)

CVE-2024-45736 (GCVE-0-2024-45736)

CVE-2024-45741 (GCVE-0-2024-45741)

CVE-2024-45734 (GCVE-0-2024-45734)

CVE-2024-45731 (GCVE-0-2024-45731)

CVE-2024-45735 (GCVE-0-2024-45735)

CVE-2024-36982 (GCVE-0-2024-36982)

CVE-2024-36996 (GCVE-0-2024-36996)

CVE-2023-46214 (GCVE-0-2023-46214)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.