Medium severity · published Jul 1, 2024
CVE-2024-36986
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands…
5.7
CVSS
0.4%
EPSS
No
On KEV
Description
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safeguards for risky commands in the Analytics Workspace. The vulnerability requires the authenticated user to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Cloud · Splunk
9.1.2308 before 9.1.2308.207; 9.1.2312 before 9.1.2312.200 · source: NVD
SP
Splunk · Splunk
9.0.0 before 9.0.10; 9.1.0 before 9.1.5; 9.2.0 before 9.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-36986
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-36986
Vendor Advisory
https://advisory.splunk.com/advisories/SVD-2024-0706
Mitigation
https://research.splunk.com/application/1cf58ae1-9177-40b8-a26c-8966040f11ae/
More from Cloud
8.8
CVE-2023-46214
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply
7.5
CVE-2024-36982
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer…
6.5
CVE-2024-36987
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the…
6.5
CVE-2024-23675
In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming…
5.3
CVE-2024-23677
In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file