CVSS: 7.5EPSS: 10%CPEs: 4EXPL: 5CVE-2024-36991 – Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows
https://notcve.org/view.php?id=CVE-2024-36991
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows. En las versiones de Splunk Enterprise en Windows inferiores a 9.2.2, 9.1.5 y 9.0.10, un atacante podría realizar un path traversal en el endpoint /modules/messaging/ en Splunk Enterprise en Windows. Esta vulnerabilidad solo debería afectar a Splunk Enterprise en Windows. • https://github.com/bigb0x/CVE-2024-36991 https://github.com/Mr-xn/CVE-2024-36991 https://github.com/th3gokul/CVE-2024-36991 https://github.com/Cappricio-Securities/CVE-2024-36991 https://github.com/sardine-web/CVE-2024-36991 https://advisory.splunk.com/advisories/SVD-2024-0711 https://research.splunk.com/application/e7c2b064-524e-4d65-8002-efce808567aa • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-35: Path Traversal: '.../ •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2024-36990 – Denial of Service (DoS) on the datamodel/web REST endpoint
https://notcve.org/view.php?id=CVE-2024-36990
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an authenticated, low-privileged user that does not hold the admin or power Splunk roles could send a specially crafted HTTP POST request to the datamodel/web REST endpoint in Splunk Enterprise, potentially causing a denial of service. En las versiones de Splunk Enterprise inferiores a 9.2.2, 9.1.5 y 9.0.10 y en las versiones de Splunk Cloud Platform inferiores a 9.2.2403.100, un usuario autenticado y con pocos privilegios que no tenga los roles de administrador o de poder de Splunk podría enviar un mensaje HTTP especialmente manipulado. Solicitud POST al modelo de datos/endpoint REST web en Splunk Enterprise, lo que podría provocar una denegación de servicio. • https://advisory.splunk.com/advisories/SVD-2024-0710 https://research.splunk.com/application/45766810-dbb2-44d4-b889-b4ba3ee0d1f5 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-36985 – Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise
https://notcve.org/view.php?id=CVE-2024-36985
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application. En las versiones de Splunk Enterprise inferiores a 9.2.2, 9.1.5 y 9.0.10, un usuario con pocos privilegios que no tenga los roles de administrador o poder de Splunk podría provocar una ejecución remota de código a través de una búsqueda externa que haga referencia a la aplicación "splunk_archiver". . • https://advisory.splunk.com/advisories/SVD-2024-0705 https://research.splunk.com/application/8598f9de-bba8-42a4-8ef0-12e1adda4131 • CWE-253: Incorrect Check of Function Return Value CWE-687: Function Call With Incorrectly Specified Argument Value •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2024-36992 – Persistent Cross-site Scripting (XSS) in Dashboard Elements
https://notcve.org/view.php?id=CVE-2024-36992
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that could result in execution of unauthorized JavaScript code in the browser of a user. The “url” parameter of the Dashboard element does not have proper input validation to reject invalid URLs, which could lead to a Persistent Cross-site Scripting (XSS) exploit. En las versiones de Splunk Enterprise inferiores a 9.2.2, 9.1.5 y 9.0.10 y en las versiones de Splunk Cloud Platform inferiores a 9.1.2312.200 y 9.1.2308.207, un usuario con pocos privilegios que no tenga los roles de administrador o poder de Splunk podría crear un payload malicioso a través de una Vista que podría resultar en la ejecución de código JavaScript no autorizado en el navegador de un usuario.bEl parámetro "url" del elemento Panel no tiene una validación de entrada adecuada para rechazar URL no válidas, lo que podría provocar un exploit de Cross-Site Scripting (XSS). • https://advisory.splunk.com/advisories/SVD-2024-0712 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-36984 – Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows
https://notcve.org/view.php?id=CVE-2024-36984
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code. En las versiones de Splunk Enterprise inferiores a 9.2.2, 9.1.5 y 9.0.10 en Windows, un usuario autenticado podría ejecutar una consulta especialmente manipulada que luego podría usar para serializar datos que no sean de confianza. El atacante podría utilizar la consulta para ejecutar código arbitrario. • https://advisory.splunk.com/advisories/SVD-2024-0704 https://research.splunk.com/application/1cf58ae1-9177-40b8-a26c-8966040f11ae • CWE-502: Deserialization of Untrusted Data •