47
CVE-2024-23676
—CVSS 3.1
3.5 low
EPSS
<1%p25
Published
()
Modified
Description
In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.
- Vendors
- splunk
- Products
- cloud, splunk
- Weakness
- CWE-20
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N