CVE-2024-36983
Command Injection using External Lookups
Severity
High 8
CVSS 3.1
Exploited
Not listed
EPSS
0.010
60.0th percentile
Discovered by
Not disclosed
Published
Jul 1, 2024
Assigned by splunk
Description
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user could create an external lookup that calls a legacy internal function. The authenticated user could use this internal function to insert code into the Splunk platform installation directory. From there, the user could execute arbitrary code on the Splunk platform Instance.
Weakness: CWE-77
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Splunk Cloud Platform | SIEM & Log Management | affected-vendor |
| Cisco | Splunk Enterprise | SIEM & Log Management | affected-vendor |
Vendor-reported products (4)
- Splunk · Splunk Enterprise
- Splunk · Splunk Cloud Platform
- splunk · splunk
- splunk · splunk_cloud_platform
Credit
Danylo Dmytriiev (DDV_UA)