Lucene search

SplunkCVE-2024-36987

HistoryJul 01, 2024 - 5:15 p.m.

CVE-2024-36987

2024-07-0117:15:07

CWE-434

Splunk

web.nvd.nist.gov

splunk

enterprise

unprivileged

upload

arbitrary extensions

rest endpoint

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

16.0%

JSON

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the admin or power Splunk roles could upload a file with an arbitrary extension using the indexing/preview REST endpoint.

Affected configurations

Nvd

Node

splunkcloudRange9.1.2312–9.1.2312.200

splunksplunkRange9.0.0–9.0.10enterprise

splunksplunkRange9.1.0–9.1.5enterprise

splunksplunkRange9.2.0–9.2.2enterprise

VendorProductVersionCPE
splunkcloud*cpe:2.3:a:splunk:cloud:*:*:*:*:*:*:*:*
splunksplunk*cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
splunk	cloud	*	cpe:2.3:a:splunk:cloud::::::::
splunk	splunk	*	cpe:2.3:a:splunk:splunk:::::enterprise:::*

CNA Affected

[
  {
    "product": "Splunk Enterprise",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "9.2",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.2.2"
      },
      {
        "version": "9.1",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.1.5"
      },
      {
        "version": "9.0",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.0.10"
      }
    ]
  },
  {
    "product": "Splunk Cloud Platform",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "9.1.2312",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.1.2312.200"
      }
    ]
  }
]

References

advisory.splunk.com/advisories/SVD-2024-0707

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

16.0%

JSON

Related for CVE-2024-36987