PT-2024-9757 · Splunk · Splunk Cloud Platform+1
Published
2024-11-19
·
Updated
2024-12-10
·
CVE-2024-53246
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Splunk Enterprise versions prior to 9.3.2
Splunk Enterprise versions prior to 9.2.4
Splunk Enterprise versions prior to 9.1.7
Splunk Cloud Platform versions prior to 9.3.2408.101
Splunk Cloud Platform versions prior to 9.2.2406.106
Splunk Cloud Platform versions prior to 9.2.2403.111
Splunk Cloud Platform versions prior to 9.1.2312.206
Description
The issue is related to the transmission of data in an open manner, potentially allowing a remote attacker to disclose protected information. In Splunk Enterprise and Splunk Cloud Platform, an SPL command can potentially disclose sensitive information. The vulnerability requires the exploitation of another vulnerability for successful exploitation.
Recommendations
For Splunk Enterprise versions prior to 9.3.2, update to version 9.3.2 or later.
For Splunk Enterprise versions prior to 9.2.4, update to version 9.2.4 or later.
For Splunk Enterprise versions prior to 9.1.7, update to version 9.1.7 or later.
For Splunk Cloud Platform versions prior to 9.3.2408.101, update to version 9.3.2408.101 or later.
For Splunk Cloud Platform versions prior to 9.2.2406.106, update to version 9.2.2406.106 or later.
For Splunk Cloud Platform versions prior to 9.2.2403.111, update to version 9.2.2403.111 or later.
For Splunk Cloud Platform versions prior to 9.1.2312.206, update to version 9.1.2312.206 or later.
Fix
Cleartext Transmission of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Splunk Cloud Platform
Splunk Enterprise