Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk

CVE-2024-45731

Summary

In Splunk Enterprise for Windows, when installed on a separate drive, a vulnerability exists that allows low-privileged users—without 'admin' or 'power' roles—to write files directly to the Windows system root directory. This results in potential unauthorized access to critical system files, posing serious security implications for affected installations, particularly versions prior to 9.3.1, 9.2.3, and 9.1.6. It is crucial for organizations using these versions to assess their configurations and apply remedial measures as detailed in the Splunk security advisory.

References