Skip to content
OpenAdvisories
High WID-SEC-2024-3168 11 CVEs

Splunk Enterprise: Mehrere Schwachstellen

Published Oct 14, 2024 · Updated Oct 14, 2024 · de-DE

Vendor: Splunk Product: Enterprise

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen.

Product

Splunk Enterprise ermöglicht Monitoring und Analyse von Clickstream-Daten und Kundentransaktionen.

Vulnerabilities 11

  • High 8.8
    CVE-2024-45733

    Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows

    In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration.

    Splunk Splunk Enterprise
  • High 8.0
    CVE-2024-45731

    Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk

    In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32…

    Splunk Splunk Enterprise
  • High 7.1
    CVE-2024-45732

    Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app

    In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could r…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2024-45736

    Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon

    In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query with an …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2024-45740

    Persistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk Enterprise

    In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through Scheduled Views that could result in ex…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2024-45741 EPSS 15%

    Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise

    In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a malicious payload through a custom configur…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.9
    CVE-2024-45738

    Sensitive information disclosure in REST_Calls logging channel

    In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure could happen if you configure the Splunk Enterprise `REST_Calls` log channel at the DEBUG logging l…

    Splunk Splunk Enterprise
  • Medium 4.9
    CVE-2024-45739

    Sensitive information disclosure in AdminManager logging channel

    In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users. This exposure could happen when you configure the Splunk Enterprise AdminManager log channel at the…

    Splunk Splunk Enterprise
  • Medium 4.3
    CVE-2024-45734

    Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard

    In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The …

    Splunk Splunk Enterprise
  • Medium 4.3
    CVE-2024-45735

    Improper Access Control for low-privileged user in Splunk Secure Gateway App

    In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the "admin" or "power" Splunk roles can see App Key Value Stor…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Medium 4.3
    CVE-2024-45737

    Maintenance mode state change of App Key Value Store (KVStore) through Cross-Site Request Forgery (CSRF)

    In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Ke…

    Splunk Splunk Enterprise Splunk Cloud Platform

Revision history

  1. #1

    Initiale Fassung

References