CVE-2024-53244

Description

In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.2.2406.107, 9.2.2403.109, and 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on “/en-US/app/search/report“ endpoint through “s“ parameter.<br>The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.

Reserved 2024-11-19 | Published 2024-12-10 | Updated 2025-01-15 | Assigner Splunk

Problem types

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Product status

9.3 before 9.3.2
affected

9.2 before 9.2.4
affected

9.1 before 9.1.7
affected

9.2.2406 before 9.2.2406.107
affected

9.2.2403 before 9.2.2403.109
affected

9.1.2312 before 9.1.2312.206
affected

References

advisory.splunk.com/advisories/SVD-2024-1202

cve.org (CVE-2024-53244)

nvd.nist.gov (CVE-2024-53244)

Download JSON