CVE-2024-53247
Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway app
Severity
High 8.8
CVSS 3.1
Exploited
Not listed
EPSS
0.011
62.6th percentile
Discovered by
Not disclosed
Published
Dec 10, 2024
Assigned by splunk
Description
In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7, and versions below 3.4.261 and 3.7.13 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could perform a Remote Code Execution (RCE).
Weakness: CWE-502
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Splunk Enterprise | SIEM & Log Management | affected-vendor |
| Cisco | Splunk Secure Gateway | SIEM & Log Management | affected-vendor |
Vendor-reported products (2)
- Splunk · Splunk Enterprise
- Splunk · Splunk Secure Gateway
Credit
Danylo Dmytriiev (DDV_UA)