Description
In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7, and versions below 3.4.261 and 3.7.13 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could perform a Remote Code Execution (RCE).
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Splunk / Splunk Enterprise9.3 – 9.3.2
- Splunk / Splunk Enterprise9.2 – 9.2.4
- Splunk / Splunk Enterprise9.1 – 9.1.7
- Splunk / Splunk Secure Gateway3.7 – 3.7.13
- Splunk / Splunk Secure Gateway3.4 – 3.4.261
References
- VENDOR_ADVISORYhttps://advisory.splunk.com/advisories/SVD-2024-1205