CVE-2024-45741

moderate-risk
Published 2024-10-14

In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a malicious payload through a custom configuration file that the "api.uri" parameter from the "/manager/search/apps/local" endpoint in Splunk Web calls. This could result in execution of unauthorized JavaScript code in the browser of a user.

Do I need to act?

~
5.3% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10 Medium
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Splunk

References (2)

Vendor Advisory https://advisory.splunk.com/advisories/SVD-2024-1011
Third Party Advisory https://research.splunk.com/application/d7b5aa71-157f-4359-9c34-e35752b1d0a2/
36
/ 100
moderate-risk
Severity 21/34 · High
Exploitability 8/34 · Low
Exposure 7/34 · Low