Medium severity · published Jan 9, 2024
CVE-2024-22165
In Splunk Enterprise Security (ES) versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service (DoS)
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
In Splunk Enterprise Security (ES) versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service (DoS). The malformed investigation prevents the generation and rendering of the Investigations manager until it is deleted.<br>The vulnerability requires an authenticated session and access to create an Investigation. It only affects the availability of the Investigations manager, but without the manager, the Investigations functionality becomes unusable for most users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Enterprise Security · Splunk
7.1.0 before 7.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22165
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22165
Vendor Advisory
https://advisory.splunk.com/advisories/SVD-2024-0102
Vendor Advisory
https://research.splunk.com/application/7f6a07bd-82ef-46b8-8eba-802278abd00e/
More from Enterprise Security
8.1
CVE-2026-76388
Privilege Escalation through Search Macro Permissions in Splunk Enterprise Security
8.1
CVE-2026-76387
SPL Injection through the REST API in Splunk Enterprise Security
4.3
CVE-2024-22164
In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation