CVE-2024-36983: Command Injection using External Lookups
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user could create an external lookup that calls a legacy internal function. The authenticated user could use this internal function to insert code into the Splunk platform installation directory. From there, the user could execute arbitrary code on the Splunk platform Instance.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36983?
CVE-2024-36983 has been rated as a medium severity vulnerability.
How do I fix CVE-2024-36983?
To fix CVE-2024-36983, upgrade to Splunk Enterprise versions 9.2.2, 9.1.5, or 9.0.10, or Splunk Cloud Platform versions 9.1.2312.109 or 9.1.2308.207.
Who is affected by CVE-2024-36983?
CVE-2024-36983 affects Splunk Enterprise and Splunk Cloud Platform users on specified versions below the threshold.
What is the impact of CVE-2024-36983?
CVE-2024-36983 allows an authenticated user to create an external lookup that exploits a legacy internal function.
Is CVE-2024-36983 specific to certain Splunk versions?
Yes, CVE-2024-36983 specifically affects Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and certain Splunk Cloud versions.