CVE-2024-36986

splunk cloud, splunk

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2024-36986

Katalog CVE

CVSS 5.7 · Medium EPSS 0,39%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada splunk cloud, splunk. Skor CVSS 3.1 5.7 (Medium) menurut NVD.

Deskripsi (NVD)

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safeguards for risky commands in the Analytics Workspace. The vulnerability requires the authenticated user to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.

Rincian

Terbit di NVD
1 Juli 2024
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
5.7 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
EPSS (30 hari)
0,39% peluang dieksploitasi; lebih tinggi dari 31,6% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
splunk cloud Versi 9.1.2308 hingga sebelum 9.1.2308.207
splunk cloud Versi 9.1.2312 hingga sebelum 9.1.2312.200
splunk splunk Versi 9.0.0 hingga sebelum 9.0.10
splunk splunk Versi 9.1.0 hingga sebelum 9.1.5
splunk splunk Versi 9.2.0 hingga sebelum 9.2.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.