Medium severity · published Jan 9, 2024
CVE-2024-22164
In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation. The attachment endpoint does not properly limit the size of the request which lets an attacker cause the Investigation to become inaccessible.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Enterprise Security · Splunk
7.1.0 before 7.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22164
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22164
Vendor Advisory
https://advisory.splunk.com/advisories/SVD-2024-0101
Vendor Advisory
https://research.splunk.com/application/bb85b25e-2d6b-4e39-bd27-50db42edcb8f/
More from Enterprise Security
8.1
CVE-2026-76388
Privilege Escalation through Search Macro Permissions in Splunk Enterprise Security
8.1
CVE-2026-76387
SPL Injection through the REST API in Splunk Enterprise Security
6.5
CVE-2024-22165
In Splunk Enterprise Security (ES) versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service (DoS)