5.7

CVE-2024-36986

Risky command safeguards bypass through Search ID query in Analytics Workspace

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safeguards for risky commands in the Analytics Workspace. The vulnerability requires the authenticated user to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Splunk ≫ Cloud Version >= 9.1.2308 < 9.1.2308.207
Splunk ≫ Cloud Version >= 9.1.2312 < 9.1.2312.200
Splunk ≫ Splunk SwEdition enterprise Version >= 9.0.0 < 9.0.10
Splunk ≫ Splunk SwEdition enterprise Version >= 9.1.0 < 9.1.5
Splunk ≫ Splunk SwEdition enterprise Version >= 9.2.0 < 9.2.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.39% 0.309
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.7 2.1 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
prodsec@splunk.com 6.3 2.1 4.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://research.splunk.com/application/1cf58ae1-9177-40b8-a26c-8966040f11ae/
Mitigation
https://advisory.splunk.com/advisories/SVD-2024-0706
Vendor Advisory