Splunk Enterprise Exposes Sensitive HTTP Parameters
CVE-2024-45738

4.9MEDIUM

Key Information:

Vendor
Splunk
Status
Splunk Enterprise
Vendor
CVE Published:
14 October 2024

Summary

In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the _internal index. This exposure could happen if you configure the Splunk Enterprise REST_Calls log channel at the DEBUG logging level.

Affected Version(s)

Splunk Enterprise 9.3 < 9.3.1

Splunk Enterprise 9.2 < 9.2.3

Splunk Enterprise 9.1 < 9.1.6

References

https://advisory.splunk.com/advisories/SVD-2024-1008
https://research.splunk.com/application/93dc7182-c5da-408...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eric McGinnis, Splunk
Rod Soto, Splunk
.