CVE-2024-45732

Description

In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data.

Reserved 2024-09-05 | Published 2024-10-14 | Updated 2025-01-02 | Assigner Splunk

Problem types

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

Product status

9.3 before 9.3.1
affected

9.2 before 9.2.3
affected

9.2.2403 before 9.2.2403.103
affected

9.1.2312 before 9.1.2312.110, 9.1.2312.200
affected

9.1.2308 before 9.1.2308.208
affected

Credits

Anton (therceman)

References

advisory.splunk.com/advisories/SVD-2024-1002

research.splunk.com/...f765c3fe-c3b6-4afe-a932-11dd4f3a024f/

cve.org (CVE-2024-45732)

nvd.nist.gov (CVE-2024-45732)

Download JSON