CVE-2024-53244

In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.2.2406.107, 9.2.2403.109, and 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on “/en-US/app/search/report“ endpoint through “s“ parameter.<br>The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2024-1202	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::

History

06 Mar 2025, 19:54

Type	Values Removed	Values Added
First Time		Splunk splunk Cloud Platform Splunk Splunk splunk
References	~~() https://advisory.splunk.com/advisories/SVD-2024-1202 -~~	() https://advisory.splunk.com/advisories/SVD-2024-1202 - Vendor Advisory
CPE		cpe:2.3:a:splunk:splunk:::::enterprise:::* cpe:2.3:a:splunk:splunk_cloud_platform::::::::
CWE		NVD-CWE-noinfo
Summary		(es) En las versiones de Splunk Enterprise anteriores a 9.3.2, 9.2.4 y 9.1.7 y en las versiones de Splunk Cloud Platform anteriores a 9.2.2406.107, 9.2.2403.109 y 9.1.2312.206, un usuario con pocos privilegios que no tenga los roles de Splunk “admin” o “power” podría ejecutar una búsqueda guardada con un comando riesgoso utilizando los permisos de un usuario con mayores privilegios para eludir las medidas de seguridad de SPL para comandos riesgosos en el punto de conexión “/en-US/app/search/report” a través del parámetro “s”.<br>La vulnerabilidad requiere que el atacante engañe a la víctima para que inicie una solicitud dentro de su navegador. El usuario autenticado no debería poder explotar la vulnerabilidad a voluntad.

10 Dec 2024, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-10 18:15

Updated : 2025-03-06 19:54

NVD link : CVE-2024-53244

Mitre link : CVE-2024-53244

CVE.ORG link : CVE-2024-53244

JSON object : View

Products Affected

splunk

splunk_cloud_platform
splunk

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo

5.7 /10