CVE-2024-23676

Summary

In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.

Affected Software

VendorProductVersion RangeStatus
SplunkSplunk Enterprise9.0 < 9.0.8affected
SplunkSplunk Enterprise9.1 < 9.1.3affected
SplunkSplunk Cloud- < 9.1.2308.200affected

Weaknesses

  • CWE-20: The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References