PT-2024-27233 · Splunk · Splunk Enterprise

Alex Hordijk

·

Published

2024-07-01

·

Updated

2026-01-23

·

CVE-2024-36985

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.2.2 Splunk Enterprise versions prior to 9.1.5 Splunk Enterprise versions prior to 9.0.10
Description A low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the splunk archiver application. This issue allows for remote code execution, potentially leading to significant security breaches.
Recommendations For versions prior to 9.2.2, update to version 9.2.2 or later. For versions prior to 9.1.5, update to version 9.1.5 or later. For versions prior to 9.0.10, update to version 9.0.10 or later. As a temporary workaround, consider restricting access to the splunk archiver application until a patch is applied.

Fix

RCE

Weakness Enumeration

CWE-687

Related Identifiers

CVE-2024-36985

Affected Products

Splunk Enterprise