Privilege Escalation in Splunk Enterprise and Cloud Platforms
CVE-2024-53244

5.7MEDIUM

Key Information:

Vendor
Splunk
Status
Splunk Enterprise
Splunk Cloud Platform
Vendor
CVE Published:
10 December 2024

Summary

A vulnerability exists in Splunk Enterprise and Cloud Platforms that allows low-privileged users to execute saved searches with risky commands. This occurs through misuse of the permissions of higher-privileged users, specifically on the '/en-US/app/search/report' endpoint. Attackers can exploit this by tricking users into making requests via phishing methods, leading to a circumvention of standard SPL safeguards. Proper administrative controls and user education are essential to mitigate this risk.

Affected Version(s)

Splunk Cloud Platform 9.2.2406 < 9.2.2406.107

Splunk Cloud Platform 9.2.2403 < 9.2.2403.109

Splunk Cloud Platform 9.1.2312 < 9.1.2312.206

References

https://advisory.splunk.com/advisories/SVD-2024-1202

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.