Splunk fixed high
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-23675 | In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST applicatio In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections. NVD description · AI analysis pending | 6.5 group max | <1% |
| — | ||
| CVE-2024-23678 | In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerability only affects Splunk Enterprise for Windows. NVD description · AI analysis pending | 8.8 | <1% |
| — |
Full article261 words · extracted from securityaffairs.com · click to collapse
Splunk addressed multiple vulnerabilities in Splunk Enterprise, including a high-severity flaw impacting Windows installs.
Splunk addressed multiple vulnerabilities in Splunk Enterprise, including a high-severity flaw, tracked as CVE-2024-23678 (CVSS score 7.5), impacting the Windows version.
According to the advisory, Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3 does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine.
Deserialization of untrusted data can allow malicious code to be executed on the system. This is because the serialized data can contain instructions that the application will execute when it deserializes the data. For example, if an application deserializes a malicious JSON object, the object could contain JavaScript code that would be executed when the application parses the JSON object.
This vulnerability only affects Splunk Enterprise for Windows.
Customers are recommended to upgrade versions 9.0.8, 9.1.3, or higher. The vendor pointed out that the vulnerability does not affect the Cloud Platform.
The issue was discovered by Danylo Dmytriiev (DDV_UA).
The company did not reveal if it is aware of attacks in the wild exploiting this vulnerability.
Below are other vulnerabilities addressed by the company:
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2024-23678)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/158019/security/splunk-flaw-windows-installs.html