Description
In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Splunk | Splunk Enterprise | 9.0 – < 9.0.8, 9.1 – < 9.1.3 | 9.0.8 |
| Splunk | Splunk Cloud | - – < 9.1.2308.200 | 9.1.2308.200 |
Advisories 1
- WID-SEC-2024-0174 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 22, 2024