Improper Access Control in Splunk Enterprise and Secure Gateway App
CVE-2024-53243

4.3MEDIUM

Key Information:

Vendor
Splunk
Status
Splunk Enterprise
Splunk Secure Gateway
Vendor
CVE Published:
10 December 2024

Summary

In affected versions of Splunk Enterprise and the Splunk Secure Gateway app, a vulnerability exists that allows low-privileged users to access alert search query results through KVstore endpoints. This occurs due to insufficient access control mechanisms, posing a risk of unauthorized data exposure.

Affected Version(s)

Splunk Enterprise 9.3 < 9.3.2

Splunk Enterprise 9.2 < 9.2.4

Splunk Enterprise 9.1 < 9.1.7

References

https://advisory.splunk.com/advisories/SVD-2024-1201

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

Credit

Anton (therceman)
.