Home

Description

In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7, and versions below 3.4.261 and 3.7.13 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could perform a Remote Code Execution (RCE).

PUBLISHED Reserved 2024-11-19 | Published 2024-12-10 | Updated 2025-02-28 | Assigner Splunk




HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Product status

9.3 (custom) before 9.3.2
affected

9.2 (custom) before 9.2.4
affected

9.1 (custom) before 9.1.7
affected

3.7 (custom) before 3.7.13
affected

3.4 (custom) before 3.4.261
affected

Credits

Danylo Dmytriiev (DDV_UA)

References

advisory.splunk.com/advisories/SVD-2024-1205

cve.org (CVE-2024-53247)

nvd.nist.gov (CVE-2024-53247)

Download JSON