Skip to content
OpenAdvisories
High WID-SEC-2024-1494 16 CVEs

Splunk Enterprise: Mehrere Schwachstellen

Published Jul 1, 2024 · Updated Jul 6, 2025 · Revision 4 · de-DE

Vendor: Debian Vendor: Splunk Product: Enterprise Product: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Splunk Enterprise ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, mehrere Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen preiszugeben

Product

Splunk Enterprise ermöglicht Monitoring und Analyse von Clickstream-Daten und Kundentransaktionen.

Vulnerabilities 16

  • High 8.8
    CVE-2024-36984

    Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code.

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2024-36985 Public exploit

    Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application.

    Splunk Splunk Enterprise
  • High 8.0
    CVE-2024-36983

    Command Injection using External Lookups

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user could create an external lookup that calls a legacy internal function. The authenticated user could use …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.8
    CVE-2023-33733 Public exploit

    Reportlab vulnerable to remote code execution

    Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.

    reportlab python-reportlab python-reportlab Debian Ubuntu PyPI
  • High 7.5
    CVE-2024-36982

    Denial of Service through null pointer reference in “cluster/config” REST endpoint

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash of the S…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.5
    CVE-2024-36991 Public exploit Scanner template EPSS 13%

    Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows

    In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

    Splunk Splunk Enterprise
  • Medium 6.5
    CVE-2024-36989

    Low-privileged user could create notifications in Splunk Web Bulletin Messages

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold the admin or power Splunk roles could create notifications in Splunk Web Bulletin Messages that all us…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2024-36990

    Denial of Service (DoS) on the datamodel/web REST endpoint

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an authenticated, low-privileged user that does not hold the admin or power Splunk roles could send a specially crafted HTTP POST request to th…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.3
    CVE-2024-36986

    Risky command safeguards bypass through Search ID query in Analytics Workspace

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safeguards for …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2024-36992

    Persistent Cross-site Scripting (XSS) in Dashboard Elements

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that c…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2024-36993

    Persistent Cross-site Scripting (XSS) in Web Bulletin

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a Splunk Web …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2024-36994

    Persistent Cross-site Scripting (XSS) in Dashboard Elements

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View and Sp…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.3
    CVE-2024-36996

    Information Disclosure of user names

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.6
    CVE-2024-36997

    Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in the browser context of another Splunk user through the conf-web/settings REST en…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2024-36987

    Insecure File Upload in the indexing/preview REST endpoint

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the admin or power Splunk roles could upload a file with an arbitrary extension using t…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2024-36995

    Low-privileged user could create experimental items

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could create experimental items.

    Splunk Splunk Enterprise Splunk Cloud Platform

Revision history

  1. #4

    PoC für CVE-2024-36991 aufgenommen

  2. #3

    Produktzuordnung überprüft

  3. #2

    Neue Updates von Debian aufgenommen

  4. #1

    Initiale Fassung

References