CVE-2024-36985
Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise
Severity
High 8.8
CVSS 3.1
Exploited
Not listed
EPSS
0.065
93.2th percentile
Discovered by
Not disclosed
Published
Jul 1, 2024
Assigned by splunk
Description
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application.
Weakness: CWE-687
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Splunk Enterprise | SIEM & Log Management | affected-vendor |
Vendor-reported products (2)
- Splunk · Splunk Enterprise
- splunk · splunk
Credit
Alex Hordijk