Login Request a demo
Medium severity · published Jan 22, 2024
CVE-2024-23675
In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming…
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Cloud · Splunk
before 9.1.2312.100 · source: NVD
SP
Splunk · Splunk
9.0.0 before 9.0.8; 9.1.0 before 9.1.3 · source: NVD
Affected product
CL
Cloud
Splunk
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23675
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23675
Vendor Advisory
https://advisory.splunk.com/advisories/SVD-2024-0105
Vendor Advisory
https://research.splunk.com/application/8f0e8380-a835-4f2b-b749-9ce119364df0/
More from Cloud
8.8
CVE-2023-46214
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply
7.5
CVE-2024-36982
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer…
6.5
CVE-2024-36987
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the…
5.7
CVE-2024-36986
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands…
5.3
CVE-2024-23677
In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file