This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Splunk Enterprise fixes multiple vulnerabilities
Splunk versions 9.1.6, 9.2.3 and 9.3.1 fix several vulnerabilities in Splunk Enterprise. Three high-severity vulnerabilities are described below [1][2][3]; others can be found here [4].
An authenticated remote attacker who does not hold the "admin" or "power" role can achieve remote code execution due to an insecure session storage configuration [1].
The vulnerability is present in product:
- Splunk Enterprise; >=9.2.0, <=9.2.2; >=9.1.0, <=9.1.5
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-45733 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
The vulnerability was publicly disclosed 14. 10. 2024.
An authenticated remote attacker who does not hold the "admin" or "power" role can write a file to the Windows root directory, specifically the System32 folder, if Splunk Enterprise is installed on a separate drive. The attacker can thus create a malicious DLL library whose loading could lead to remote code execution [2].
The vulnerability is present in product:
- Splunk Enterprise; =9.3.0; >=9.2.0, <=9.2.2; >=9.1.0, <=9.1.5
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
More information:
- CVE-2024-45731 at cve.org, NVD
- CWE-23: Relative Path Traversal at cwe.mitre.org
The vulnerability was publicly disclosed 14. 10. 2024.
An authenticated remote attacker with low privileges, who does not hold the "admin" or "power" role, can run a search as the "nobody" user in the SplunkDeploymentServerConfig app and access potentially restricted data [3].
The vulnerability is present in product:
- Splunk Enterprise; =9.3.0; >=9.2.0, <=9.2.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
More information:
- CVE-2024-45732 at cve.org, NVD
- CWE-862: Missing Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 14. 10. 2024.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 22. 10. 2024.