CVE-2024-45738
Sensitive information disclosure in REST_Calls logging channel
Severity
Medium 4.9
CVSS 3.1
Exploited
Not listed
EPSS
0.005
39.4th percentile
Discovered by
Not disclosed
Published
Oct 14, 2024
Assigned by splunk
Description
In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure could happen if you configure the Splunk Enterprise `REST_Calls` log channel at the DEBUG logging level.
Weakness: CWE-200
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Splunk Enterprise | SIEM & Log Management | affected-vendor |
Vendor-reported products (1)
- Splunk · Splunk Enterprise
Credit
Eric McGinnis, Splunk