CVE-2024-36983

Description

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user could create an external lookup that calls a legacy internal function. The authenticated user could use this internal function to insert code into the Splunk platform installation directory. From there, the user could execute arbitrary code on the Splunk platform Instance.

Reserved 2024-05-30 | Published 2024-07-01 | Updated 2025-01-02 | Assigner Splunk

Problem types

The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Product status

9.2 before 9.2.2
affected

9.1 before 9.1.5
affected

9.0 before 9.0.10
affected

9.1.2312 before 9.1.2312.109
affected

9.1.2308 before 9.1.2308.207
affected

Credits

Danylo Dmytriiev (DDV_UA)

References

advisory.splunk.com/advisories/SVD-2024-0703

research.splunk.com/...1cf58ae1-9177-40b8-a26c-8966040f11ae/

cve.org (CVE-2024-36983)

nvd.nist.gov (CVE-2024-36983)

Download JSON