CVE-2024-45734
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Splunk | Splunk Enterprise | 9.2 < 9.2.3 | affected |
| Splunk | Splunk Enterprise | 9.1 < 9.1.6 | affected |
Weaknesses
- CWE-284: The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: partial
References
- https://advisory.splunk.com/advisories/SVD-2024-1004
- https://research.splunk.com/application/7464e2dc-98a5-4af9-87a1-fa6d5a256fa6/
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.