CVE-2024-36987

Description

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the admin or power Splunk roles could upload a file with an arbitrary extension using the indexing/preview REST endpoint.

Reserved 2024-05-30 | Published 2024-07-01 | Updated 2025-01-02 | Assigner Splunk

Problem types

The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

Product status

9.2 before 9.2.2
affected

9.1 before 9.1.5
affected

9.0 before 9.0.10
affected

9.1.2312 before 9.1.2312.200
affected

Credits

Kyle Bambrick, Splunk

References

advisory.splunk.com/advisories/SVD-2024-0707

cve.org (CVE-2024-36987)

nvd.nist.gov (CVE-2024-36987)

Download JSON