CVE-2024-36992

Summary

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that could result in execution of unauthorized JavaScript code in the browser of a user. The “url” parameter of the Dashboard element does not have proper input validation to reject invalid URLs, which could lead to a Persistent Cross-site Scripting (XSS) exploit.

Affected Software

VendorProductVersion RangeStatus
SplunkSplunk Enterprise9.2 < 9.2.2affected
SplunkSplunk Enterprise9.1 < 9.1.5affected
SplunkSplunk Enterprise9.0 < 9.0.10affected
SplunkSplunk Cloud Platform9.1.2312 < 9.1.2312.200affected
SplunkSplunk Cloud Platform9.1.2308 < 9.1.2308.207affected

Weaknesses

  • CWE-79: The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References