PT-2024-7418 · Splunk · Splunk Enterprise

Eric Mcginnis

+1

·

Published

2024-10-14

·

Updated

2024-10-17

·

CVE-2024-45739

CVSS v2.0

6.8

Medium

VectorAV:N/AC:L/Au:S/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.3.1 Splunk Enterprise versions prior to 9.2.3 Splunk Enterprise versions prior to 9.1.6
Description: The software potentially exposes plaintext passwords for local native authentication Splunk users when the Splunk Enterprise AdminManager log channel is configured at the DEBUG logging level. This issue is related to insufficient protection of service data, which could allow a remote attacker to disclose protected information.
Recommendations: For versions prior to 9.3.1, update to version 9.3.1 or later to resolve the issue. For versions prior to 9.2.3, update to version 9.2.3 or later to resolve the issue. For versions prior to 9.1.6, update to version 9.1.6 or later to resolve the issue. As a temporary workaround, consider avoiding the configuration of the Splunk Enterprise AdminManager log channel at the DEBUG logging level until a patch is available.

Fix

Information Disclosure

Insertion into Log File

Weakness Enumeration

Related Identifiers

BDU:2024-08792
CVE-2024-45739

Affected Products

Splunk Enterprise