This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Splunk Enterprise fixes 2 vulnerabilities

Splunk fixes 2 vulnerabilities in the Splunk Enterprise product in versions 9.2.1, 9.1.4 and 9.0.9 [1][2].

Splunk Enterprise - SPL command execution (CVE-2024-29946)
CVSS 8.1 (High)

An unauthenticated remote attacker can execute SPL commands with high privileges. Exploiting the vulnerability requires the Splunk web interface to be enabled and the attacker to trick the victim into submitting a request via their web browser [1].

The vulnerability is present in product:

  • Splunk Enterprise; >=9.2.0.0, <9.2.1; >=9.1.0, <9.1.4; >=9.0.0, <9.0.9;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 27. 3. 2024.

Splunk Enterprise - authentication token exposure (CVE-2024-29945)
CVSS 7.2 (High)

An authenticated remote attacker with administrator rights to internal indexes can view authentication tokens without authorization. The vulnerability affects only instances that have global debugging and/or debugging of the "JsonWebToken" component enabled - instructions for verifying this and other suitable steps, besides updating, if the vulnerability is confirmed can be found at [2].

The vulnerability is present in product:

  • Splunk Enterprise; >=9.2.0.0, <9.2.1; >=9.1.0, <9.1.4; >=9.0.0, <9.0.9;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 27. 3. 2024.

By CESNET, z.s.p.o. Martin Krajči on 28. 3. 2024.

CESNET, z.s.p.o. Logo