High severity · published Jul 1, 2024
CVE-2024-36997
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in…
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in the browser context of another Splunk user through the conf-web/settings REST endpoint. This could potentially cause a persistent cross-site scripting (XSS) exploit.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Splunk · Splunk
9.0.0 before 9.0.10; 9.1.0 before 9.1.5; 9.2.0 before 9.2.2 · source: NVD
SC
Splunk Cloud Platform · Splunk
9.1.2312 before 9.1.2312.100 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-36997
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-36997
Vendor Advisory
https://advisory.splunk.com/advisories/SVD-2024-0717
Tool Signature
https://research.splunk.com/application/ed1209ef-228d-4dab-9856-be9369925a5c
More from Splunk
9.8
CVE-2026-20253
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
7.5
CVE-2014-0160
OpenSSL Information Disclosure Vulnerability
10.0
CVE-2022-32158
Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server
9.8
CVE-2026-76285
Improper Adherence to Coding Standards in Splunk Enterprise
9.8
CVE-2026-76284
Improper Neutralization in Splunk Enterprise