Home

Description

In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.2.2406.107, 9.2.2403.109, and 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on “/en-US/app/search/report“ endpoint through “s“ parameter.<br>The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.

PUBLISHED Reserved 2024-11-19 | Published 2024-12-10 | Updated 2025-02-28 | Assigner Splunk




MEDIUM: 5.7CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Problem types

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Product status

9.3 (custom) before 9.3.2
affected

9.2 (custom) before 9.2.4
affected

9.1 (custom) before 9.1.7
affected

9.2.2406 (custom) before 9.2.2406.107
affected

9.2.2403 (custom) before 9.2.2403.109
affected

9.1.2312 (custom) before 9.1.2312.206
affected

References

advisory.splunk.com/advisories/SVD-2024-1202

cve.org (CVE-2024-53244)

nvd.nist.gov (CVE-2024-53244)

Download JSON