cve-2024-36986
Vulnerability from cvelistv5
Published
2024-07-01 16:30
Modified
2024-10-30 15:06
Severity ?
EPSS score ?
Summary
Risky command safeguards bypass through Search ID query in Analytics Workspace
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Splunk | Splunk Enterprise | |
Splunk | Splunk Cloud Platform |
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-36986", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-07-02T20:10:45.837210Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-03T13:53:42.646Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:43:50.752Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://advisory.splunk.com/advisories/SVD-2024-0706" }, { "tags": [ "x_transferred" ], "url": "https://research.splunk.com/application/1cf58ae1-9177-40b8-a26c-8966040f11ae/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Splunk Enterprise", "vendor": "Splunk", "versions": [ { "lessThan": "9.2.2", "status": "affected", "version": "9.2", "versionType": "custom" }, { "lessThan": "9.1.5", "status": "affected", "version": "9.1", "versionType": "custom" }, { "lessThan": "9.0.10", "status": "affected", "version": "9.0", "versionType": "custom" } ] }, { "product": "Splunk Cloud Platform", "vendor": "Splunk", "versions": [ { "lessThan": "9.1.2312.200", "status": "affected", "version": "9.1.2312", "versionType": "custom" }, { "lessThan": "9.1.2308.207", "status": "affected", "version": "9.1.2308", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "value": "Anton (therceman)" } ], "datePublic": "2024-07-01T00:00:00.000000", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safeguards for risky commands in the Analytics Workspace. The vulnerability requires the authenticated user to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will." } ], "value": "In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safeguards for risky commands in the Analytics Workspace. The vulnerability requires the authenticated user to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will." } ], "metrics": [ { "cvssV3_1": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.", "lang": "en", "type": "cwe" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-30T15:06:33.489Z", "orgId": "42b59230-ec95-491e-8425-5a5befa1a469", "shortName": "Splunk" }, "references": [ { "url": "https://advisory.splunk.com/advisories/SVD-2024-0706" }, { "url": "https://research.splunk.com/application/1cf58ae1-9177-40b8-a26c-8966040f11ae/" } ], "source": { "advisory": "SVD-2024-0706" }, "title": "Risky command safeguards bypass through Search ID query in Analytics Workspace" } }, "cveMetadata": { "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469", "assignerShortName": "Splunk", "cveId": "CVE-2024-36986", "datePublished": "2024-07-01T16:30:42.325Z", "dateReserved": "2024-05-30T16:36:21.000Z", "dateUpdated": "2024-10-30T15:06:33.489Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2024-36986\",\"sourceIdentifier\":\"prodsec@splunk.com\",\"published\":\"2024-07-01T17:15:06.910\",\"lastModified\":\"2024-08-02T15:24:42.677\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safeguards for risky commands in the Analytics Workspace. The vulnerability requires the authenticated user to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.\"},{\"lang\":\"es\",\"value\":\"En las versiones de Splunk Enterprise inferiores a 9.2.2, 9.1.5 y 9.0.10 y en las versiones de Splunk Cloud Platform inferiores a 9.1.2312.200 y 9.1.2308.207, un usuario autenticado podr\u00eda ejecutar comandos riesgosos utilizando los permisos de un usuario con mayores privilegios para evitar SPL. salvaguardias para comandos riesgosos en Analytics Workspace. La vulnerabilidad requiere que el usuario autenticado realice phishing a la v\u00edctima enga\u00f1\u00e1ndola para que inicie una solicitud dentro de su navegador. El usuario autenticado no deber\u00eda poder explotar la vulnerabilidad a voluntad.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.1,\"impactScore\":3.6},{\"source\":\"prodsec@splunk.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.1,\"impactScore\":4.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]},{\"source\":\"prodsec@splunk.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:splunk:cloud:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.1.2308\",\"versionEndExcluding\":\"9.1.2308.207\",\"matchCriteriaId\":\"92689196-A27A-49A9-974D-9DAB239DA3F1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:splunk:cloud:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.1.2312\",\"versionEndExcluding\":\"9.1.2312.200\",\"matchCriteriaId\":\"D906AB2D-B882-4482-9A3B-53A01A28152A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"9.0.0\",\"versionEndExcluding\":\"9.0.10\",\"matchCriteriaId\":\"09264EE5-FA8A-49C5-AB1F-AEAC16CDC591\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"9.1.0\",\"versionEndExcluding\":\"9.1.5\",\"matchCriteriaId\":\"565039EE-74F6-451C-AFB3-F6C9F7AA0EEE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"9.2.0\",\"versionEndExcluding\":\"9.2.2\",\"matchCriteriaId\":\"B1342052-4733-49BB-95F0-A89B07A3F2E3\"}]}]}],\"references\":[{\"url\":\"https://advisory.splunk.com/advisories/SVD-2024-0706\",\"source\":\"prodsec@splunk.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://research.splunk.com/application/1cf58ae1-9177-40b8-a26c-8966040f11ae/\",\"source\":\"prodsec@splunk.com\",\"tags\":[\"Mitigation\"]}]}}" } }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.