PT-2024-4753 · Splunk · Splunk Cloud Platform+1
Kyle Bambrick
·
Published
2024-05-30
·
Updated
2024-08-02
·
CVE-2024-36987
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions:
Splunk Enterprise versions prior to 9.2.2
Splunk Enterprise versions prior to 9.1.5
Splunk Enterprise versions prior to 9.0.10
Splunk Cloud Platform versions prior to 9.1.2312.200
Description:
The issue is related to the Upload Data module in the Splunk Web interface of Splunk Enterprise, which allows an authenticated, low-privileged user to upload a file with an arbitrary extension using the "indexing/preview" REST endpoint. This could enable a remote attacker to write arbitrary files.
Recommendations:
For Splunk Enterprise versions prior to 9.2.2, update to version 9.2.2 or later.
For Splunk Enterprise versions prior to 9.1.5, update to version 9.1.5 or later.
For Splunk Enterprise versions prior to 9.0.10, update to version 9.0.10 or later.
For Splunk Cloud Platform versions prior to 9.1.2312.200, update to version 9.1.2312.200 or later.
As a temporary workaround, consider restricting access to the "indexing/preview" REST endpoint until a patch is available.
Fix
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Splunk Cloud Platform
Splunk Enterprise