CVE-2024-36983: Command Injection using External Lookups
First published: Mon Jul 01 2024(Updated: )
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user could create an external lookup that calls a legacy internal function. The authenticated user could use this internal function to insert code into the Splunk platform installation directory. From there, the user could execute arbitrary code on the Splunk platform Instance.
Credit: prodsec@splunk.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Splunk Enterprise Security | <9.2.2<9.1.5<9.0.10 | |
| Splunk Cloud Platform | <9.1.2312.109<9.1.2308.207 | |
| Splunk | >=9.0.0<9.0.10 | |
| Splunk | >=9.1.0<9.1.5 | |
| Splunk | >=9.2.0<9.2.2 | |
| Splunk Cloud Platform | >=9.1.2308<9.1.2308.207 | |
| Splunk Cloud Platform | >=9.1.2312<9.1.2312.109 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-36983?
CVE-2024-36983 has been rated as a medium severity vulnerability.
How do I fix CVE-2024-36983?
To fix CVE-2024-36983, upgrade to Splunk Enterprise versions 9.2.2, 9.1.5, or 9.0.10, or Splunk Cloud Platform versions 9.1.2312.109 or 9.1.2308.207.
Who is affected by CVE-2024-36983?
CVE-2024-36983 affects Splunk Enterprise and Splunk Cloud Platform users on specified versions below the threshold.
What is the impact of CVE-2024-36983?
CVE-2024-36983 allows an authenticated user to create an external lookup that exploits a legacy internal function.
Is CVE-2024-36983 specific to certain Splunk versions?
Yes, CVE-2024-36983 specifically affects Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and certain Splunk Cloud versions.
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- agent/weakness
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- vendor/splunk
- canonical/splunk enterprise security
- canonical/splunk cloud platform
- canonical/splunk
- version/splunk/9.0.0
- version/splunk/9.1.0
- version/splunk/9.2.0
- version/splunk cloud platform/9.1.2308
- version/splunk cloud platform/9.1.2312