CVE-2024-45732: In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110…

PriorityP336medium6.5CVSS 3.1

AVNACLPRLUINSUCHINAN

EPSS

0.40%

31.5th percentile

In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
splunk	splunk	—	—
splunk	splunk	>= 9.2.0 < 9.2.3	9.2.3
splunk	splunk_cloud_platform	< 9.1.2308.208	9.1.2308.208
splunk	splunk_cloud_platform	>= 9.1.2308 < 9.1.2308.208	9.1.2308.208
splunk	splunk_cloud_platform	>= 9.1.2312 < 9.1.2312.110, 9.1.2312.200	9.1.2312.110, 9.1.2312.200
splunk	splunk_cloud_platform	>= 9.1.2312.100 < 9.1.2312.110	9.1.2312.110
splunk	splunk_cloud_platform	>= 9.2.2403 < 9.2.2403.103	9.2.2403.103
splunk	splunk_cloud_platform	>= 9.2.2403.102 < 9.2.2403.103	9.2.2403.103
splunk	splunk_enterprise	>= 9.2 < 9.2.3	9.2.3
splunk	splunk_enterprise	>= 9.3 < 9.3.1	9.3.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.