CVE-2024-36991

Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

En las versiones de Splunk Enterprise en Windows inferiores a 9.2.2, 9.1.5 y 9.0.10, un atacante podría realizar un path traversal en el endpoint /modules/messaging/ en Splunk Enterprise en Windows. Esta vulnerabilidad solo debería afectar a Splunk Enterprise en Windows.

*Credits: Danylo Dmytriiev (DDV_UA)

CVSS Scores

NISTv3.1 7.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

Poc

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-30 CVE Reserved
2024-07-01 CVE Published
2024-07-06 First Exploit
2024-10-16 EPSS Updated
2024-10-30 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-35: Path Traversal: '.../...//'

CAPEC

References (7)

URL	Tag	Source

URL	Date	SRC
https://github.com/bigb0x/CVE-2024-36991	2024-07-08
https://github.com/Mr-xn/CVE-2024-36991	2024-07-06
https://github.com/th3gokul/CVE-2024-36991	2024-07-06
https://github.com/Cappricio-Securities/CVE-2024-36991	2024-07-10
https://github.com/sardine-web/CVE-2024-36991	2024-07-06

URL	Date	SRC

URL	Date	SRC
https://advisory.splunk.com/advisories/SVD-2024-0711	2024-07-22
https://research.splunk.com/application/e7c2b064-524e-4d65-8002-efce808567aa	2024-07-22

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Splunk Search vendor "Splunk"	Splunk Search vendor "Splunk" for product "Splunk"	>= 9.0.0 < 9.0.10 Search vendor "Splunk" for product "Splunk" and version " >= 9.0.0 < 9.0.10"	enterprise	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Splunk Search vendor "Splunk"	Splunk Search vendor "Splunk" for product "Splunk"	>= 9.1.0 < 9.1.5 Search vendor "Splunk" for product "Splunk" and version " >= 9.1.0 < 9.1.5"	enterprise	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Splunk Search vendor "Splunk"	Splunk Search vendor "Splunk" for product "Splunk"	>= 9.2.0 < 9.2.2 Search vendor "Splunk" for product "Splunk" and version " >= 9.2.0 < 9.2.2"	enterprise	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe