Lucene search

SplunkCVE-2024-29946

HistoryMar 27, 2024 - 5:15 p.m.

CVE-2024-29946

2024-03-2717:15:54

CWE-1287

CWE-77

CWE-20

Splunk

web.nvd.nist.gov

126

splunk enterprise

dashboard studio

vulnerability

versions 9.2.1

9.1.4

9.0.9

spl commands

bypass

safeguards

phishing

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

47.2%

JSON

In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phish the victim by tricking them into initiating a request within their browser.

Affected configurations

Nvd

Node

splunksplunkRange9.0.0–9.0.9enterprise

splunksplunkRange9.1.0–9.1.4enterprise

splunksplunkRange9.2.0–9.2.1enterprise

VendorProductVersionCPE
splunksplunk*cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
splunk	splunk	*	cpe:2.3:a:splunk:splunk:::::enterprise:::*

CNA Affected

[
  {
    "product": "Splunk Enterprise",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "9.2",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.2.1"
      },
      {
        "version": "9.1",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.1.4"
      },
      {
        "version": "9.0",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.0.9"
      }
    ]
  },
  {
    "product": "Splunk Cloud Platform",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "-",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.1.2312.104"
      },
      {
        "version": "-",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.1.2308.205"
      }
    ]
  }
]

References

advisory.splunk.com/advisories/SVD-2024-0302

research.splunk.com/application/1cf58ae1-9177-40b8-a26c-8966040f11ae/

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

47.2%

JSON

Related for CVE-2024-29946