PT-2024-6817 · Splunk · Splunk Enterprise
Alex Hordijk
·
Published
2024-10-14
·
Updated
2024-10-22
·
CVE-2024-45733
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Splunk Enterprise versions prior to 9.2.3
Splunk Enterprise versions prior to 9.1.6
Description
The issue is related to insecure session storage configuration in Splunk Enterprise for Windows, allowing a low-privileged user without the "admin" or "power" Splunk roles to perform Remote Code Execution (RCE). This is due to deficiencies in the deserialization mechanism of the Splunk Web component.
Recommendations
For versions prior to 9.2.3, update to version 9.2.3 or later.
For versions prior to 9.1.6, update to version 9.1.6 or later.
As a temporary workaround, consider restricting access to the session storage configuration to minimize the risk of exploitation.
Fix
RCE
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Splunk Enterprise