Information disclosure in Splunk Enterprise - CVE-2024-53244
Published: December 11, 2024
Vulnerability identifier: #VU101662
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-53244
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote user can run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on "/en-US/app/search/report" endpoint through "s" parameter. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.
Affected software
Splunk Enterprise
Splunk Cloud Platform
Splunk Cloud Platform
How to mitigate CVE-2024-53244
Install updates from vendor's website.
Splunk Enterprise - addressed in versions 9.1.7, 9.2.4, 9.3.2
Splunk Cloud Platform - addressed in versions 9.1.2312.206, 9.2.2403.109, 9.2.2406.107
Splunk Cloud Platform - addressed in versions 9.1.2312.206, 9.2.2403.109, 9.2.2406.107