Skip to content
OpenAdvisories
High NCSC-2024-0276 15 CVEs

Kwetsbaarheden verholpen in Splunk

Published Jul 2, 2024 · Updated Jul 2, 2024 · nl

Vendor: Splunk Product: splunk Product: Splunk Cloud Platform Product: Splunk Enterprise

Summary

De ontwikkelaars van Splunk hebben kwetsbaarheden verholpen in Splunk en Splunk Enterprise.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, willekeurige code uit te (laten) voeren middels Command-injection, of om een Cross-Site-Scripting-aanval uit te voeren. Een dergelijke aanval kan leiden tot uitvoer van willekeurige code in de browser van het slachtoffer, of toegang tot gevoelige gegevens in de context van de browser van het slachtoffer.

Oplossingen
Splunk heeft updates uitgebracht voor Splunk en Splunk Enterprise. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 15

  • High 8.8
    CVE-2024-36984

    Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code.

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2024-36985 Public exploit

    Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application.

    Splunk Splunk Enterprise
  • High 8.0
    CVE-2024-36983

    Command Injection using External Lookups

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user could create an external lookup that calls a legacy internal function. The authenticated user could use …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.5
    CVE-2024-36982

    Denial of Service through null pointer reference in “cluster/config” REST endpoint

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash of the S…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.5
    CVE-2024-36991 Public exploit Scanner template EPSS 13%

    Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows

    In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

    Splunk Splunk Enterprise
  • Medium 6.5
    CVE-2024-36989

    Low-privileged user could create notifications in Splunk Web Bulletin Messages

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold the admin or power Splunk roles could create notifications in Splunk Web Bulletin Messages that all us…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2024-36990

    Denial of Service (DoS) on the datamodel/web REST endpoint

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an authenticated, low-privileged user that does not hold the admin or power Splunk roles could send a specially crafted HTTP POST request to th…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.3
    CVE-2024-36986

    Risky command safeguards bypass through Search ID query in Analytics Workspace

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safeguards for …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2024-36992

    Persistent Cross-site Scripting (XSS) in Dashboard Elements

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that c…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2024-36993

    Persistent Cross-site Scripting (XSS) in Web Bulletin

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a Splunk Web …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2024-36994

    Persistent Cross-site Scripting (XSS) in Dashboard Elements

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View and Sp…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.3
    CVE-2024-36996

    Information Disclosure of user names

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.6
    CVE-2024-36997

    Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in the browser context of another Splunk user through the conf-web/settings REST en…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2024-36987

    Insecure File Upload in the indexing/preview REST endpoint

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the admin or power Splunk roles could upload a file with an arbitrary extension using t…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2024-36995

    Low-privileged user could create experimental items

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could create experimental items.

    Splunk Splunk Enterprise Splunk Cloud Platform

Revision history

  1. #0

    Initiele versie

References