CVE-2024-23678
Deserialization of Untrusted Data on Splunk Enterprise for Windows through Path Traversal from Separate Disk Partition
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 0.22 % · percentile 12 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Splunk
- NVD status
- Modified
Description
In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerability only affects Splunk Enterprise for Windows.
Weaknesses (CWE)
- CWE-20 — Improper Input Validation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H | Splunk |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H | NVD · prodsec@splunk.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-21149
- GCVE · GCVE-0-2024-23678
CERT-FR advisories
- CERTFR-2024-AVI-0061 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 9.0.0 < 9.0.8cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 9.1.0 < 9.1.3
Affected products
| Product | Versions |
|---|---|
| Splunk · Splunk Enterprise | affected 9.0 < 9.0.8 ; affected 9.1 < 9.1.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |