RCE in Splunk
CVE-2024-36983
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user could create an external lookup that calls a legacy internal function. The authenticated user could use this internal function to insert code into the Splunk platform installation directory. From there, the user could execute arbitrary code on the Splunk platform Instance.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.010 (60.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Splunk
- Splunk Cloud Platform — versions 9.1.2312, 9.1.2308
- Splunk Splunk_cloud_platform
- Splunk Enterprise — versions 9.2, 9.1, 9.0
Weakness classification (CWE)
References
- prodsec@splunk.com (Vendor Advisory)
- prodsec@splunk.com (Tool Signature)
Frequently asked questions
- What is CVE-2024-36983?
- CVE-2024-36983 is a high-severity vulnerability in Splunk, classified under Command Injection. CVSS score: 8.0/10. Published 2024-07-01.
- How severe is CVE-2024-36983?
- High severity. CVSS v3 base score is 8.0 out of 10.