CVE-2024-36991

CVSS 3.1: 7.5 high
EPSS: 13%p96
Published: Jul 1, 2024 · Jul 1, 2024
Modified: Jun 17, 2026

Analyze CVE-2024-36991 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

Vendors: splunk

Products: splunk

Weakness: CWE-35, CWE-22

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (13.0%)

In the news

3 stories

Week in review: CrowdStrike update causes widespread IT outage, critical Splunk Enterprise flaw

Help Net SecurityJul 29, 16:16 UTC · Jul 29, 2024Data breachCVE-2024-36991 CVE-2024-39929 CVE-2024-20401+22 · 1 read

Critical Splunk flaw can be exploited to grab passwords (CVE-2024-36991)

Help Net SecurityJul 18, 00:00 UTC · Jul 18, 2024VulnerabilityExploitedCVE-2024-369912 · 1 read

Splunk fixed tens of flaws in Splunk Enterprise and Cloud Platform

Security AffairsJul 4, 09:06 UTC · Jul 4, 2024Exploit / PoCExploitedCVE-2024-36985 CVE-2024-36984 CVE-2024-36997+123 · 1 read