CVE-2024-23678: Deserialization of Untrusted Data on Splunk Enterprise for Windows through Path Traversal from Separate Disk Partition
In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerability only affects Splunk Enterprise for Windows.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterprise for Windowsto a version that resolves this vulnerability.Fixed in 9.0.8 - Upgrade
Upgrade
Splunk Enterprise for Windowsto a version that resolves this vulnerability.Fixed in 9.1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23678?
CVE-2024-23678 is categorized as a high severity vulnerability due to its potential for unsafe deserialization of untrusted data.
Which versions of Splunk Enterprise are affected by CVE-2024-23678?
CVE-2024-23678 affects Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3.
How do I fix CVE-2024-23678?
To fix CVE-2024-23678, upgrade to Splunk Enterprise versions 9.0.8 or 9.1.3 or later.
What type of attack does CVE-2024-23678 enable?
CVE-2024-23678 enables an attacker to exploit unsafe deserialization, which can potentially compromise the security of the system.
Is CVE-2024-23678 specific to a particular operating system?
Yes, CVE-2024-23678 specifically affects Splunk Enterprise for Windows.